11
$\begingroup$

I got a question about the HKDF Scheme by Hugo Krawczyk. On the following link you can find a small explanation of the HKDF-Scheme and some short informations. The HKDF specification itself has been published as RFC 5869.

I got two questions about the short informations. It is said that:

  1. Research results obtained in recent years point out to the advantages of building KDF functions based on HMAC rather than on plain hash functions as traditional schemes do.

    What are the advantages? What is exactly meant by that?

  2. In particular, these results show that an HMAC-based KDF can be founded on weaker assumptions on the underlying hash function
    …
    Based on such results we propose HKDF, a fully-specified HMAC-based KDF, that can serve multiple applications under a wide variety of requirements and under relaxed assumptions on the hash functions.

    What assumptions are exactly meant?

It would be very nice if someone can give me some short explanations or some thoughts.

Improve this question
$\endgroup$
1
  • $\begingroup$ I think there are also some theoretical issues with using a hash directly in the sense that the KDF would rely on properties that are not explicitly required to consider a hash secure. I think one of these was the property that the result must be fully indistinguishable from random. But I'll be danged if I remember these properties precisely. $\endgroup$
    – Maarten Bodewes ♦
    Dec 14, 2016 at 14:12

1 Answer 1

Reset to default
5
$\begingroup$

For example, there are no current attacks to HMAC-MD5, although MD5 is broken for several years. Hash functions have very strong requirements (e.g., collision resistance, preimage resistance, etc.), and some hash functions have been shown to fail some of these requirements (e.g., MD5 is not collision resistant). Hash-based KDFs may be affected by the problems of these hash functions, since they directly use their output, normally a concatenation of iterated inputs. On the contrary, HKDF only requires that the compression function behaves like a PRF, which is a much weaker assumption.

See these other questions for more details:

Is HMAC-MD5 considered secure for authenticating encrypted data?

Security of KDF1 and KDF2 (hash based KDF's)

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.