Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Assume I have a password with sufficient entropy but may not be uniformly distributed, how can I turn the password into a key that can be used for symmetric encryption?
I think there is surely such a method because when you type gpg -c it asks for a passphrase (more or less a password) not a key.
Ideally this method doesn't require a salt for ease of implementation, unless it's proven impossible.
For passwords with sufficient entropy you can use a KBKDF - a key based key derivation function - that allows a non-constant sized input and performs entropy extraction. The extraction of entropy into an intermediate form of a specific size is made explicit in HKDF by a function called HKDF-extract.
HKDF follows the "extract-then-expand" paradigm, where the KDF logically consists of two modules. The first stage takes the input keying material and "extracts" from it a fixed-length pseudorandom key K. The second stage "expands" the key K into several additional pseudorandom keys (the output of the KDF).
In many applications, the input keying material is not necessarily distributed uniformly, and the attacker may have some partial knowledge about it (for example, a Diffie-Hellman value computed by a key exchange protocol) or even partial control of it (as in some entropy-gathering applications). Thus, the goal of the "extract" stage is to "concentrate" the possibly dispersed entropy of the input keying material into a short, but cryptographically strong, pseudorandom key. In some applications, the input may already be a good pseudorandom key; in these cases, the "extract" stage is not necessary, and the "expand" part can be used alone.
Keys can then be derived from that intermediate state by HKDF-expand, which allows additional input parameters such as in the info field that may - for instance - include a label identifying the key to receive the output keying material.
Usually the extraction phase is implicit - not explicitly identified; this is for instance the case for other KDF's that rely on hash functions.
In others the extraction is not present; this is for instance the case for many KDF's that rely on block ciphers. Those start off with a symmetric key, which needs to conform to the requirements of symmetric keys that already presume "concentrated" entropy.
HKDF does not require a salt. It does take a salt as parameter but it may be empty. HKDF is significantly strengthened by a salt though, see chapter 3.1 for more information on when / how to apply a salt with HKDF.
The discussion about these principles for HKDF is applicable to many KDF's that may be equally secure within the protocols where they are used. The good thing of HKDF is that the principles are explicitly named and therefore - hopefully - well argued & applied.
gpg -cgenerates a salt and stores it alongside the ciphertext. $\endgroup$