TAHOE-LAFS uses a form of "key-dependent encryption", in that a private key SK is encrypted with the truncated hash of the private key:

ENC(Htrunc(SK), SK)

Where Htrunc(X) is the result of SHA256(SHA256(X)), truncated to 16 bytes.

The TAHOE-LAFS paper states:

This somewhat unusual arrangement means that the RSA signing key is encrypted with the truncation of the secure hash of itself. This is an instance key-dependent encryption, which is not as well-studied as we would like. However, we think that it would be surprising if there were a weakness in this construction which did not imply a weakness in the underlying standard primitives – RSA, AES-128, and SHA256.

What are the practical consequences of the use of this construction? Is the paper right in saying that if the underlying primitives are secure, this scheme should be secure as well?

  • $\begingroup$ What is ENC, specifically? How is it instantiated? $\endgroup$
    – D.W.
    Apr 3, 2014 at 10:52
  • $\begingroup$ I'm not sure about TAHOE-LAFS, but for my uses I am considering AES CCM. (Edit: TAHOE-LAFS uses AES-CTR) $\endgroup$ Apr 3, 2014 at 14:08

1 Answer 1


There are no known dangers or attacks from this construction. I agree with the quote from the TAHOE-LFS paper. I would find it quite surprising if this use of the key material introduced some special weakness. I can't prove it, but based upon my professional judgement, this is probably far from the biggest risk to your security -- it is very unlikely that this is the weakest link in the system. It is far more likely that the weakest link is something else (e.g., endpoint security, the human processes, social engineering). So, personally I wouldn't worry about this.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.