3
$\begingroup$

I'm new when it comes to cryptography so this question might be a little bit stupid:

Can I derive a key with Curve25519 from a (let's say) root key and encrypt the file with a secret key algorithm? Or should I better use a key derivation function like PBKDF2?

Improve this question
$\endgroup$
4
  • $\begingroup$ You could use Curve25519 if you don't have the private root key (available) and want the owner to be able to recover the file. If you have a secret key, using a standard key-based key derivation function (KBKDF) like HKDF would be best and something like Argon2 or bcrypt if you "only" have a password available. $\endgroup$
    – SEJPM
    Commented Jun 3, 2016 at 14:02
  • $\begingroup$ Thanks for your answer. The idea behind this is: <br/> We've got a root key, key encryption key, master encryption key and data encryption key. These 3 keys are being derived from the root key. The DEK encrypts the data, the MEK encrypts the DEK and the KEK encrypts the MEK. Must a KBKDF still be used? Does my way of thinking even make any sense? $\endgroup$
    – Kro
    Commented Jun 3, 2016 at 14:30
  • $\begingroup$ So the device / program / whatever which is performing the key derivation is supposed to know the root key or some top level key (the KEK?), the MK and the DEK? $\endgroup$
    – SEJPM
    Commented Jun 3, 2016 at 14:34
  • $\begingroup$ That is correct. $\endgroup$
    – Kro
    Commented Jun 3, 2016 at 14:37

1 Answer 1

Reset to default
3
$\begingroup$

What you actually want is called a key-based key derivation function (KBKDF).
The most prominent KBKDF (and really the standard solution here) is HKDF.

This is a function that takes a secret key (e.g. a KEK or a root key or something) and outputs (a set of) derived keys enjoying some nice properties.

  • You can customize the keys to get different keys for different purposes, e.g. you can add a purpose-string to them which ensure you won't accidently re-use some key material
  • You can salt the key material. This way you can store a (non-secret) salt with the object to be encrypted and this will ensure all files enjoy distinct encryption keys (and the customization ensure each key-based operation on an object has a different key)
  • Given a derived key it is impossible to find any other keys except for those derived from the leaked one.
  • The derivation process isn't computationally expensive (especially compared to PBKDF2 and Curve25519)

Now for a short clarification:

  • Curve25519 is an elliptic curve used to perform signature operations and derive keys between two distinct parties such that no passive attacker can obtain the negotiated key. This clearly doesn't apply to you as you already have the key material.
  • PBKDF2 is an (old) password based key derivation function which is used to process passwords such that the operation takes more time and thus it is more computationally expensive for an attacker to brute-force a password out of a given key. This one does not apply to you because your key material has such high entropy that an attacker doesn't have a chance at brute-forcing anyways.
Improve this answer
$\endgroup$
1
  • $\begingroup$ Thank you very much for your answer! Now I can see the things clearer! $\endgroup$
    – Kro
    Commented Jun 3, 2016 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.