I need a PRF for use with PBKDF2, however, the only thing I have is the AES block cipher primitive. I'm attempting to derive a keyed hash function from the block cipher. The design is based on the Merkle–Damgård construction. The inputs are $i$ and $k$, for the input data and key, both are a list a bytes. The byte 0xff is appended to $i$, and then subsequent 0x00 bytes are appended until $length(i) \mod 16 = 0$. $i$ is then split into $length(i)/16$ blocks in the array $b$. And then the algorithm continues as follows. $$s_{-1} = k$$ $$s_x = E_{s_{x-1}}(b_x)$$ $$h = s_0 \oplus s_1 \oplus s_2 ... \oplus s_{length(b)-1}$$ $h$ is then returned as the resulting hash. Is this secure enough to use with PBKDF2?
$\begingroup$
$\endgroup$
1
-
1$\begingroup$ Anything speaking against more standard constructions as can be found in the Handbook of Applied Cryptography? $\endgroup$– SEJPMJan 15, 2016 at 19:31
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
1
If you want to construct a PRF for arbitrarily-long inputs using AES, then just use CBC-MAC (while prepending the message length in the first block). I don't see any advantage in what you are proposing and therefore don't see any point in trying to analyze something non-standard.
answered Jan 16, 2016 at 19:27