1
$\begingroup$

Quote:

The chosen output length of the key derivation function SHOULD be the same as the length of the underlying one-way function output.

Could someone please help explain the benefits and concerns?

$\endgroup$
2
$\begingroup$

It would be a benefit for badly defined PBKDF's such as PBKDF2. PBKDF2 re-iterates all the iterations if you ask more than the output of the one-way function. This requires the server to perform additional calculations. The attacker however might be able to validate that a guessed password is correct without going through the same number of iterations.

This would for instance be the case if you split the output into a 256 bit key and 128 bit IV when using PBKDF2 - SHA-256 - in that order. The key would be calculated first, then the entire work of hashing is repeated for the IV. But an attacker would only need the first 256 bits to confirm a guess.


Some older KBKDF's and PBKDF's such as KDF1/2 and PBKDF1 also simply do not allow for outputting more than the output size of the one-way function.


Newer KDF's such as HKDF (a key based KDF or KBKDF) and Argon2 (a password based KDF or PBKDF) have been specifically designed to allow for more output than the one-way function. It should however be remembered that retrieving a 256 bit key from a function that can only provide 160 bits of security will not give you 256 bits security.

This might be the main reason for the given statement.


That the output size needs to be precisely the output size of the one-way function is, in my opinion, hogwash. It is perfectly reasonable to ask 512 bits of output and split it into two times 256 bits, while the one-way function only provides 256 bits of security. It is nicer to use two labels and perform a KBKDF twice, but that's not necessarily more secure.

Besides that, it is certainly completely valid to ask for fewer bytes than the one-way function provides.


Commonly the output size is a configuration parameter for the KDF. But you might want to consider to use the most up to date KBKDF or PBKDF if you ask for more bits than the one-way function provides. As long as you don't fool yourself with regards to the key strength provided by the KDF, you should be perfectly safe (at least in theory: specification / implementation failures and catastrophic breaks of KDF's are not covered by this insurance).

$\endgroup$
  • 1
    $\begingroup$ I just love criticizing NIST and rewriting the rules of OWASP and such, thanks for that question :P Thanks go to CodesInChaos for first notifying me of the issue with asking for more than the output of the hash function for PBKDF2. $\endgroup$ – Maarten Bodewes Jul 13 '18 at 12:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.