3
$\begingroup$

Using $SHA256(N)$, where $N$ is 64 bytes of output from the Microsoft Windows CryptGenRandom function. Are there any known vulnerabilities with using this method to create key material? Should $N$ be more than the SHA256 block size of 64 bytes? Aligning to block size means 2 passes through the (internal) hashing function, (block and finalize), is this enough?

$\endgroup$
  • 1
    $\begingroup$ I would personally do 119 bytes, that fills the 2nd block to capacity $\endgroup$ – Richie Frame Sep 4 '14 at 19:40
  • $\begingroup$ @Richie Frame, I think you might be right. The reason I align to the block is of course a resource factor. Having stepped through SHA256 code many times, I just can't see why it would matter.. but still, it may be a potential vulnerability. It's a trade off I'm not sure I want to make. $\endgroup$ – JGU Sep 4 '14 at 19:48
  • 2
    $\begingroup$ Personally, I'd use HMAC-SHA256. See this paper for why and some other possible constructions to consider (especially if your processor has AES-NI). $\endgroup$ – mikeazo Sep 4 '14 at 19:51
  • $\begingroup$ @mikeazo -That occurred to me as well, I can't remember why I didn't use HMAC, I'll take a look at it again.. thanks $\endgroup$ – JGU Sep 4 '14 at 19:53
2
$\begingroup$

CryptGenRandom is supposed to produce cryptographically strong random numbers, so you shouldn't need to process it before using as a key.

However, if you want to treat it as of suspect quality, I would go with SP 800-90B recommendations: assume it has entropy at least half the bits, so request double what you need. Then run it through HMAC with a suitable hash function.

| improve this answer | |
$\endgroup$
  • $\begingroup$ @Otus, another great answer, thank you. It's not so much that RNGCrypto is suspect, it's more about insuring that if it ever were revealed to have exploitable flaws, that fact would have little impact on the overall security of the system. I'll spend some time looking at HMAC and adjusting the block size and weigh the trade offs.. thanks again. $\endgroup$ – JGU Sep 4 '14 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.