1
$\begingroup$

Can an RSA signature of a randomly generated seed be used as a secret material (for further protection of some data)?

That sounds like some sort of KDF - but here built on top of the RSA signature operation, instead of the encryption/decryption operation, that is typically used by KDFs. (Or are there some known KDFs that work that way?)

Such usage of signatures is unusual, as conceptually the signature is intended to be a non-secret information to be shared with other parties. But are there any known cryptographic concerns here, or maybe some cross-protocol pitfalls?

Note that the question assumes the PKCS#1 v1.5, as the PSS signature includes randomness and therefore can't be directly used for deriving a stable secret.

|improve this question
$\endgroup$
  • $\begingroup$ The question is self contradictory to me. "a randomly generated seed" vs "be used as a secret material". Why not use the (presumably) randomly generated seed itself as the key? Are you hoping to use a keyed signature as a RNG? $\endgroup$ – Paul Uszak Sep 1 '17 at 14:29
  • $\begingroup$ The seed itself isn't derived from the RSA key, while the question's aim is to make the desired secret to be generatable only from the private key. Re your second question (essentially, "how the secret is going to be used then") - this probably goes outside the scope of the question, but the idea was about using it as a source data for another KDF (a password-based one or, likely, some better-suited one) that would give an encryption key as a result. $\endgroup$ – Max Sep 1 '17 at 15:08
2
$\begingroup$

Yes, the idea of using RSA signature as KDF can work. The KDF's key will be the RSA private key, and the other input of the KDF will be the message to sign. Other requirements:

  1. Either:
    1. The signature is post-processed by a cryptographically secure PRF, e.g. a hash (which will make the output of the KDF indistinguishable from random, and the KDF uninvertible).
    2. Perhaps: It is kept only suitably little low-order bits of the raw output of the integer constituting the RSA signature. Without proof, I conjecture that for $n$-bit RSA, and secure deterministic signature padding, the low-order $n/3$ bits are indistinguishable from random, and the KDF uninvertible (including with the public key).
    3. It maters neither that the "secret material" output of the KDF is distinguishable from random, nor that the input of the KDF is reconstructible form its output (e.g. by one holding the public key, or because some bits are distinguishable from random).
  2. It is used a secure deterministic RSA signature scheme, including RSASSA-PKCS1-v1_5 of PKCS#1, and ISO/IEC 9796-2 scheme 1 and 3.
  3. The signing procedure does not force something variable in the signed message, nor in the part of the signature actually used.

Requirement 1 insures that the output of the KDF has the desired properties. With 1.1 or perhaps 1.2 (an unproven shortcut to save a hash), the output of the KDF is indistinguishable from random, and the KDF is not invertible. With 1.3 the signature itself can be the output (no matter how it is formatted, including e.g. base64), and that could be usable for a KDF generating, from public material, some output that only needs to be unpredictable and not colliding, but can be long and distinguishable from random.

Requirements 2/3 are there to insure that the KDF is worth the name function, that is the same input always yields the same output. Requirement 2 excludes randomized RSA signatures, including RSASSA-PSS of PKCS#1v2, and ISO/IEC 9796-2 scheme 2. Requirement 3 excludes, for example, a Smart Card that would increment an internal counter at each signature, and force that in the message being signed, or (combined with 1.1 or 1.3) as a suffix to the signature.

Unfortunately, I know no reference.

|improve this answer
$\endgroup$
  • $\begingroup$ Thank for the thorough response! Of requirement 1, item 1.3 sounds fine, as the plan was to use a further KDF to finally derive an encryption key... But do you maybe know if there's some literature that analyzes the RSA signature being used as a KDF? Any references will be greatly appreciated. $\endgroup$ – Max Sep 1 '17 at 15:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.