# Can I use a random number generator with seed for key derivation?

I don't know a thing about cryptography so I'm judging by what I see in APIs docs. I want to use ECDSA or ECDH in my project. And what I know so far about key derivation in this systems is that they:

1. generate a random private key $d$
2. then do some fancy stuff with it to get a public key $dG$

My question is: can I use a random number generator that works with seeds?

Like if we say thatrandom(seed) produces random numbers from set A. And if random(seed1) -> set A, random(seed2) -> set B, seed1 != seed2, Then A != B or at least A is as far as possible from being equal to B

• This seems like a long and arduous road ahead. Elliptics are the hardest part of cryptography, and given your starting point, it doesn't bode well for success. It would be safer (security wise) to start with simpler encryptions like stream ciphers. Also look towards output collisions and key /seed size. – Paul Uszak Nov 10 '17 at 10:53
• Where are you getting the seeds, what PRNG are you using, and what do you plan to do with the output? – Reid Rankin Nov 10 '17 at 13:39
• The seeds are just random variables user can set. And I thought maybe it is possible to prevent private key collision if the seeds are different in a p2p network – Furetur Nov 10 '17 at 13:48
• @FureturPhyarell It's not sufficient that the private keys be different; they must also be unguessable. If you use a PRNG with a user-supplied seed, someone can guess at likely seeds ("1111", "1234", etc.), and for each one run the seed -> PRNG -> private key -> public key computation and see if it matches any actual user's public key. Unless you use a slow PRNG, an attacker can try a huge number of guesses very fast. As a result, key generation must always be seeded with a large amount of unguessable information. – Gordon Davisson Nov 11 '17 at 7:50
• I mean seed, of course, mustn't define a singular private key. When you give a seed to a random generator it should generate a private key from some set of numbers defined by the seed. Well/ I think I will have to do some research on my own – Furetur Nov 13 '17 at 17:50

My question is: can I use a random number generator that works with seeds?

Yes.

All you need is a 256-bit uniform random secret, or a seed chosen by a process with 256 bits of min-entropy. You can derive everything else from there using a key derivation function like HKDF-SHA256, which is—securitywise—just a kind of PRNG with a convenient API to name what the purpose of each derived key is so that you can reproduce the computation.

For example, you could ask a computer to generate for you a 20-word diceware phrase $$p$$. You can convert it into a 256-bit effectively uniform random secret $$k$$ with $$\operatorname{HKDF-Extract}(p)$$; then, from $$k$$, you can derive:

• an AES-GCM-256 key for notes in a private todo list with $$k_1 = \operatorname{HKDF-Expand}(k, \text{‘todo list key 1’})$$
• an ECDSA key for a Bitcoin wallet with $$d = \operatorname{HKDF-Expand}(k, \text{‘Bitcoin wallet, 2019-03-23’})$$
• an RSA key using a particular prime generation procedure with a particular choice of PRNG seeded with $$s = \operatorname{HKDF-Expand}(k, \text{‘my RSA key seed’})$$. Of course, RSA key generation is rather slow! So people don't usually do this.

There are two key points:

1. You must let a computer or fair dice rolls choose the phrase $$p$$ for you, and then commit it to memory. Don't try to think of $$p$$ yourself first, because you are bad at thinking randomly.
2. The labels must all be distinct. All bets are off if you use the same label for two different purposes.