1
$\begingroup$

I am looking at G now, but is there a better, (in terms of security and speed), means by which a byte array can be expanded that doesn't involve another cipher, just a simple algorithm?

I need to expand 1024 bytes to 4096 for use in a stream cipher, and speed is less important than overall distribution of entropy. I am also trying to find something that is strictly algorithmic, that doesn't employ hashing or another cipher. Any thoughts/recommendations?

$\endgroup$
  • 1
    $\begingroup$ What will you use it for? The key expansion in Rijndael is very simple and not good for anything that expects a random key. HKDF Expand is a good choice for many uses, but it needs a hash function. $\endgroup$ – otus Sep 5 '14 at 19:38
  • 2
    $\begingroup$ Use a hash function like Keccak? $\endgroup$ – Richie Frame Sep 5 '14 at 19:38
  • 2
    $\begingroup$ Well, "most secure" is to use a kdf, which normally means using at least a block cipher or hash function. However, depending on what you use the derived key for, something simpler could be secure enough. $\endgroup$ – otus Sep 5 '14 at 19:49
  • 1
    $\begingroup$ The stream cipher should have sufficient diffusion that every bit of output depends on every bit of state for it to be secure. So even concatenating zero bytes may be sufficient. However, the specifics depend on the cipher. (Don't roll your own bears repeating but I'm going to assume yours is for fun.) $\endgroup$ – otus Sep 5 '14 at 20:10
  • 1
    $\begingroup$ @John You could take a look at sosemanuk, which uses serpent as key expansion. $\endgroup$ – CodesInChaos Sep 5 '14 at 20:21
2
$\begingroup$

There are many possibilities here, depending on the particulars of where exactly you will use it.

  1. Your use case may require a random looking derived key, where the 1024 bytes of entropy have been distributed evenly over all the bytes of the final key. In that case there's no avoiding a key derivation function. You will have to use either a block cipher, a hash function, or something equally complex.

  2. Your use of it in a stream cipher may not care at all, if the entropy will be subsequently diffused over the state anyway (maybe with extra initial rounds). In that case you may as well just set the rest of the bytes to zero, or perhaps concatenate four copies of the original key to increase the speed of initial diffusion.

  3. The second point above may be true, but your cipher may have internal symmetries that could make certain bits or bytes "cancel out". In that case you may have to make sure the initial configuration does not lead to weaknesses due to that symmetry.

  4. You may have some sort of security proof or reduction for the structure of the cipher, like a Feistel network has, for example. That could put requirements on the key, e.g. that certain parts have to differ. HMAC is an example where simply padding the key with two different bit patterns was sufficient for proofs.

In the end, the main guidance I would give out is to look at what other stream ciphers are doing. The eSTREAM winners would be a decent starting place.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Thanks Otus.. I ended up going with HMAC/HKDF-Expand, (and more realistic state sizes). $\endgroup$ – JGU Sep 10 '14 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.