Is a KDF needed when using X25519 for ECDH and XChaCha20-Poly1305 or XSalsa20-Poly1305 for authenticated encryption?

My hypothesis is "no" because the key from X25519 is less than 256 bits long; therefore, it can be used in XChaCha20-Poly1305 directly, as ChaCha20 is considered immune to related-key attacks.

  • $\begingroup$ Immunity to related key attacks is not enough - a raw ECDH value can at least theoretically give the attacker known key bits, which a KDF solves. $\endgroup$
    – otus
    Commented May 14, 2016 at 14:42

1 Answer 1


Generally speaking, there are (at least) three reasons to put a KDF in between an DH shared secret and the bulk encryption.

  1. Improved re-usability. If you don't post-process the shared secret with a KDF there's no way to give the sender and the recipient different keys for each direction or to split up authentication and encryption keys. An additional bonus would be, that if you keep the shared secret, you could easily implement a session resumption feature by increasing some helper counter which is fed into the KDF.
  2. Weaker security reduction assumptions. If you feed the shared secret into a KDF, then you only rely on the CDH problem holding (and model the KDF as a random oracle). If you feed the key directly into a cipher, you rely on the DDH assumption which is known to be broken for some groups where the CDH holds.
  3. Better match with expected key properties. Symmetric ciphers are constructed, modeled and analyzed with only fully random keys in mind (or some computationally indistinguishable variant). However DH and ECDH shared secrets are integers and curve points which exhibit structure which violates the randomness assumption. A quick pass through a KDF doesn't cost much and fixes this.

Glossary: KDF: key derivation function; CDH: computational diffie-hellman problem; DDH: decisional diffie-hellman problem; DH: diffie-hellman; shared secret: result of a DH key agreement protocol execution; ECDH: elliptic curve variant of diffie-hellman

  • $\begingroup$ Why you only rely on the CDH when using a KDF? Could you elaborate please? $\endgroup$
    – user35869
    Commented Oct 10, 2019 at 8:16
  • $\begingroup$ @Marm standard proofs for hybrid encryption rely on CDH so that the input to the random oracle is unpredictable which in turn guarantees a completely unpredictable output of the RO. $\endgroup$
    – SEJPM
    Commented Oct 10, 2019 at 8:31
  • $\begingroup$ is this still required if the cipher is not vulnerable to related-key attacks? ChaCha20 is a keyed hash function in counter mode. $\endgroup$
    – Demi
    Commented Nov 26, 2021 at 2:34
  • $\begingroup$ @Demi yes, keys should always be uniformly random and the first point still stands if course. $\endgroup$
    – SEJPM
    Commented Nov 26, 2021 at 8:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.