# IND-CPA Security

Given a key $K$ (the key is fixed) and a nonce $N$ (changes from one message to another)

Using a secure Key derivation function (KDF) such as the ANSI-X9.63-KDF with SHA-1 option to derive a key for encryption

Can we reach the IND-CPA security level for our encryption ?

• I assume you mean obtaining an ephemeral key $k_N=$KDF($K | N$)?
– rath
Feb 28, 2014 at 21:52
• What kind of encryption would you use? If you have a key and a nonce, you shouldn't really need a KDF as well. You could use one in various ways, but ...
– K.G.
Feb 28, 2014 at 22:35
• @K.G: Symmetric encryption.
– zof
Feb 28, 2014 at 22:45
• If you have a key and a nonce, you are done (use AES-GCM or even AES-CBC reach IND-CPA). Why ask about KDFs?
– K.G.
Mar 1, 2014 at 18:00
• I am using a secure KDF to randomize the outputs from one message to another. The derived key Kn=KDF(k|n) is then used in OTP namely C = Kn Xor M .
– zof
Mar 1, 2014 at 18:26

Yes, you can.

Your construction $C=P\oplus KDF(K||N)$ is IND-CPA secure, assuming the KDF is secure, which is reasonable. This construction can be used and is sometimes used with ECIES (meaning $E_K(M)=K\oplus M$), but I'd recommend against using it. Replacing the KDF with AES is as secure as the above construction, as this mode is called CTR-mode, which is proven to be IND-CPA secure.

For practical purposes, as there are better solutions, which already provide higher security levels (IND-CCA2).
I strongly recommend you not to use AES-CTR or "KDF-CTR" but rather use AES-GCM, which provides you with full authentication at high speeds with constant-size tags.

• the claim that the construction is IND-CPA can be justified by this answer. Jul 9, 2015 at 20:33