It seems that not every MAC is a KDF. But would any PRF also work as both KDF and MAC? Could someone explain the relationship between these 3 definitions?
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
A key derivation function (KDF) takes in some secret keying material, which may or may not be uniformly distributed, and where the adversary may also have some auxiliary information about the keying material or its distribution, and outputs a uniformly distributed bit string. See definitions 5, 6, and 7, here.
Intuitively, a KDF's job is to take in some keying material which has some minimum entropy, but which might not be uniform as a bit string (or not be a bit string at all!), and output a "smooth" bit string of essentially the same entropy as the original input. A classic use case is a Diffie-Hellman (DH) secret obtained from a key exchange protocol. This secret is not a bit string, but rather a group element. Moreover, when encoded as a bit string, this group element will not be uniformly distributed over all bit strings of the corresponding length. However, it does have high entropy, and a KDF can then be used to extract from the secret DH group element a nice and uniformly distributed bit string (i.e., a symmetric key).
The security definition of a KDF (Def. 7 in the link above), is essentially that it should behave like a random function when evaluated on the secret keying material and some arbitrary additional input (there are some additional bells and whistles in Def. 7 provided in the link, but what I said contains the gist of it).
A pseudorandom function (PRF) takes in a secret key and a message, and outputs a bit string. The security requirement for a PRF (see Def. 5.6, here) is that it should behave like a random function when evaluated on arbitrary messages---provided the secret key is uniformly distributed.
Notice that PRFs and KDFs are quite similar, but that a PRF has a much more stringent requirement on its secret key. Essentially, a non-uniformly distributed secret key voids all security guarantees of a PRF.
A message authentication code (MAC) takes in a secret key and a message, and outputs a tag. There is also a corresponding verification algorithm that on input the secret key, a message, and a tag, outputs either VALID/NOT-VALID. The security requirement of a MAC is that for someone not knowing the secret key, it should be hard to come up with a message and a tag, such that the verification algorithm outputs VALID. (Note that this is a very weak form of MAC security, and usually we require something stronger called EUF-CMA security, see Def. 9.1 and Def. 9.2 here).
As for the relationships between them, it follows from what I wrote above that KDF $\implies$ PRF $\implies$ MAC. That is, since a KDF is supposed to behave like a random function even when given a non-uniform secret key, it of course also behaves like a random function when the secret key is uniformly distributed. That a PRF allows you to build a MAC is shown in Section 9.6 here.
In the other direction none of the implications hold generally. That is, it is not the case that all secure MACs are secure PRFs (can you think of a counterexample?), and not all secure PRFs are secure KDFs.
$\begingroup$
$\endgroup$
About any MAC is a KDF you can find answer here: Can any MAC be used as a KDF? And there is HKDF which based on HMAC (https://en.wikipedia.org/wiki/HKDF).
MAC is used to confirm that the message came from the stated sender and has not been changed.
KDF is used to strengthen the security of the symmetric key after DH (Diffie-Hellman).
I am not sure, but in TLS 1.2 PRF is used for Key Calculation. You can read more details from RFC 5246:
https://tools.ietf.org/html/rfc5246#section-5
https://tools.ietf.org/html/rfc5246#section-6.3
Clarification needed in TLS 1.2 key derivation process also have answer about MAC and PRF.
