I see that KDFs should be used in systems that rely on PSKs, but what practical benefit does it provide?

For instance, suppose the system relies on a shared secret for AES encryption and decryption. If the en/decryption uses a key derived from a KDF, an attacker could still sniff the key and decrypt the file. Yes, the key could be regenerated using the secret, but for the purpose of en/decryption, it would remain fixed unless compromise is detected.

So, under what scenarios does KDF increase protection? Is it just to increase the entropy of the key so that it'd be harder to crack?



An important principle in cryptography is "key separation" which holds that one should "use distinct keys for distinct algorithms and distinct modes of operation". Violating key separation often opens up avenues of attacks that may break confidentiality, integrity, or even recover the key.

You can use a KDF to derive cryptographically independent keys from a single "master key", and then use those keys in different algorithms and/or modes, thus respecting key separation.

The paper "On the importance of the key separation principle for different modes of operation" (Gligoroski et al) provides the definition of key separation that I used above, and a description of some attacks that are possibly when key separation is violated.

| improve this answer | |
  • $\begingroup$ Why not just generate random keys instead of deriving from a single "master key"? Is there any benefit to using a master key? $\endgroup$ – Shruggie Mar 8 '19 at 3:51
  • $\begingroup$ The benefit of a "master key" is that there are less keys to manage. In a DH key exchange two parties agree on a limited amount of shared secret key material (the "master key" in this context) and the parties use a KDF to produce many distinct keys for separate purposes (such as key confirmation, data encryption, message authentication). In PSK or password-based file encryption you can derive separate MAC and encryption keys from a single password. When authenticated key agreement is not possible, a KDF can derive daily/working keys from a long-term shared secret to limit the secret's exposure $\endgroup$ – Trevor Davel Apr 16 '19 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.