1
$\begingroup$

I need a PRF for use with PBKDF2, however, the only thing I have is the AES block cipher primitive. I'm attempting to derive a keyed hash function from the block cipher. The design is based on the Merkle–Damgård construction. The inputs are $i$ and $k$, for the input data and key, both are a list a bytes. The byte 0xff is appended to $i$, and then subsequent 0x00 bytes are appended until $length(i) \mod 16 = 0$. $i$ is then split into $length(i)/16$ blocks in the array $b$. And then the algorithm continues as follows. $$s_{-1} = k$$ $$s_x = E_{s_{x-1}}(b_x)$$ $$h = s_0 \oplus s_1 \oplus s_2 ... \oplus s_{length(b)-1}$$ $h$ is then returned as the resulting hash. Is this secure enough to use with PBKDF2?

$\endgroup$
2
$\begingroup$

If you want to construct a PRF for arbitrarily-long inputs using AES, then just use CBC-MAC (while prepending the message length in the first block). I don't see any advantage in what you are proposing and therefore don't see any point in trying to analyze something non-standard.

$\endgroup$
  • $\begingroup$ Alternatively, just use CMAC $\endgroup$ – poncho Jan 16 '16 at 20:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.