Assume I have a password with sufficient entropy but may not be uniformly distributed, how can I turn the password into a key that can be used for symmetric encryption?

I think there is surely such a method because when you type gpg -c it asks for a passphrase (more or less a password) not a key.

Ideally this method doesn't require a salt for ease of implementation, unless it's proven impossible.

  • $\begingroup$ hash it by some secure hash function, e.g. Keccac $\endgroup$
    – user27950
    Jul 14 '18 at 9:15
  • $\begingroup$ Why the result will be uniformly distributed $\endgroup$
    – Cyker
    Jul 14 '18 at 9:19
  • $\begingroup$ it is one of the assumed properties of secure hash functions. But you should take care that the entropy you put into the hash is greater than or equal to the output bits of the hash. Alternatively, you can use only as much bits from the hash as your input has entropy. $\endgroup$
    – user27950
    Jul 14 '18 at 9:24
  • $\begingroup$ Using a hash reminds me of random oracle. But on the other hand, a hash function is deterministic, assuming there's no collision, the distribution of hashed passwords is the same as that of the un-hashed? So if the un-hashed are non-uniform ... $\endgroup$
    – Cyker
    Jul 14 '18 at 9:42
  • $\begingroup$ gpg -c generates a salt and stores it alongside the ciphertext. $\endgroup$ Jul 15 '18 at 6:46

For passwords with sufficient entropy you can use a KBKDF - a key based key derivation function - that allows a non-constant sized input and performs entropy extraction. The extraction of entropy into an intermediate form of a specific size is made explicit in HKDF by a function called HKDF-extract.

HKDF follows the "extract-then-expand" paradigm, where the KDF logically consists of two modules. The first stage takes the input keying material and "extracts" from it a fixed-length pseudorandom key K. The second stage "expands" the key K into several additional pseudorandom keys (the output of the KDF).

In many applications, the input keying material is not necessarily distributed uniformly, and the attacker may have some partial knowledge about it (for example, a Diffie-Hellman value computed by a key exchange protocol) or even partial control of it (as in some entropy-gathering applications). Thus, the goal of the "extract" stage is to "concentrate" the possibly dispersed entropy of the input keying material into a short, but cryptographically strong, pseudorandom key. In some applications, the input may already be a good pseudorandom key; in these cases, the "extract" stage is not necessary, and the "expand" part can be used alone.

Keys can then be derived from that intermediate state by HKDF-expand, which allows additional input parameters such as in the info field that may - for instance - include a label identifying the key to receive the output keying material.

Usually the extraction phase is implicit - not explicitly identified; this is for instance the case for other KDF's that rely on hash functions.

In others the extraction is not present; this is for instance the case for many KDF's that rely on block ciphers. Those start off with a symmetric key, which needs to conform to the requirements of symmetric keys that already presume "concentrated" entropy.

HKDF does not require a salt. It does take a salt as parameter but it may be empty. HKDF is significantly strengthened by a salt though, see chapter 3.1 for more information on when / how to apply a salt with HKDF.

The discussion about these principles for HKDF is applicable to many KDF's that may be equally secure within the protocols where they are used. The good thing of HKDF is that the principles are explicitly named and therefore - hopefully - well argued & applied.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.