2
$\begingroup$

Consider a case where we have a master key MS that is used in pseudo-random function to generate a set of pseudo-random values. Then we use key derivation function to derive a key from each of pseudo-random values. Assume all the keys are long enough (in security context).

Question: In the above scenario can I use the keys derived from the pseudo-random values (or the derived keys) as a encryption key or a key for pseudo-random function?

In other words, is there any situation where we should not consider a derived key as an actual random key?

| improve this question | |
$\endgroup$
2
$\begingroup$

Yes, this is exactly what KDFs and PRFs are designed for. That is, no reasonably efficient attacker will be able to tell if you used an actual random key or something generated from the KDF/PRF. This is of course assuming that your initial seed/master secret was of sufficient entropy, and the way you derive the various values are not done in a silly way.

The practice of deriving many keys from an initial master secret using a KDF is extremely common and you will find it used in almost any standard security protocol like TLS, IPsec or SSH.

In other words, is there any situation where we should not consider a derived key as an actual random key?

Above I only considered security from the perspective of practice, i.e., where we assume that the adversary cannot run for an arbitrarily long time. However, in a theoretical model where we allow the adversary to run arbitrarily long, there are many examples where using anything other than a totally random string will break your security. The most common example of course being the one-time pad.

| improve this answer | |
$\endgroup$
  • $\begingroup$ Thank you for the answer. My question is now, if I have a proper seed (or key) for pseudorandom function. If I use the key and pseudorandom function, can I consider the outputs of the pseudorandom function as the keys? In other words, can I use the output of PRF instead of output of KDF as the proper keys? $\endgroup$ – user153465 Nov 24 '15 at 17:03
  • $\begingroup$ Could you also tell me please, what function I can use for KDF. $\endgroup$ – user153465 Nov 24 '15 at 17:04
  • $\begingroup$ let $f$ be pseudorandom function and $KDF$ be key derivation function. I have a truly random key, $k$. I generate $n$ pseudorandom values: $v_i=f(k,i), 1\leq i \leq n$. Then I generate $n$ keys: $k_i=KDF(v_i)$. hy cannot I consider $v_i$ as a valid key (in this case I do not need KDF anymore? $\endgroup$ – user153465 Nov 24 '15 at 17:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.