I mean something like a NIST, ISO, FIPS or similar standard which defines a constructions for a PRF.
$\begingroup$
$\endgroup$
2
-
$\begingroup$ Keccak has a build in keyed mode, but I'm not sure if NIST standardized it as part of SHA-3. $\endgroup$– CodesInChaosFeb 9, 2017 at 13:55
-
$\begingroup$ @CodesInChaos NIST standardized KMAC (keyed SHA-3) as part of SP 800-185 (PDF). $\endgroup$– SEJPMFeb 9, 2017 at 16:00
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
1
HMAC is the standard way to construct a PRF from a hash function.
FIPS PUB 198-1 - The Keyed-Hash Message Authentication Code (HMAC) (NIST standard)
RFC-2104 HMAC: Keyed-Hashing for Message Authentication (informational RFC)
(Unfortunately the above standards only describe it as a MAC, not as a PRF)
It's also very popular in practice. For example it's used in SSL/TLS, SSH, HOTP/TOTP.
I recommend using it with SHA-2 as the underlying hash function. Though technically the known weaknesses of MD5 and SHA1 don't apply to keyed use in HMAC, so even those obsolete hashes could still be used as PRF in the HMAC construction.
answered Feb 9, 2017 at 13:58
-
2$\begingroup$ For MD5 and SHA1 "could still be used" actually means: If you have them in a system, there is no need to panic. For new development: Don't use them. $\endgroup$– tyloFeb 9, 2017 at 17:51
$\begingroup$
$\endgroup$
@CodesInChaos already mentioned HMAC, so I won't repeat it. I'll add, however:
- NIST 800-38B specifies CMAC, a block cipher mode that can be used as a variable input length MAC or PRF.
- There are several standardized variants of the CBC-MAC which might be provably PRFs, but CBC-MAC is hard to use right—CMAC is likely a safer choice.
Rogaway's "Evaluation of Some Blockcipher Modes of Operation" is a very useful survey of all of these (HMAC, CMAC and CBC-MAC variants), that mentions which ones are NIST, ISO and ANSI standards, summarizes results about their security and provides a good bibliography as well.
answered Feb 10, 2017 at 1:22