3
$\begingroup$

I'm in a project, where the output of a Key Agreement algorithm (uses ECC) is used as input for a KDF, and the output of the KDF (X9.63 KDF) is consecutively used as input for a PRF (CMAC) to calculate AES session keys.

Summary: ECC-PAKE->KDF->PRF->AES_keys.

My question: Is there any major advantage of using both KDF and PRF? Wouldn't the KDF good enough in this scencario?

$\endgroup$
3
$\begingroup$

Assuming the KDF is actually secure,There is no clear advantage other than domain separation, and certainly some severe disadvantages (code complexity and size).

If you have the ability to change things, I would simply use one call to HKDF-SHA256 or HKDF-SHA512 once to get all the bytes you need. SHA-256 is hardware accelerated on some platforms so you might prefer that.

Many crypto libraries have HKDF, if not it is trivial to implement correctly if you have an HMAC primitive available.

UPDATE: I now see that the latest ANSI X9.63 still specifies SHA-1 as its hashing primitive. SHA-1 is broken in terms of collision-resistance. While that doesn’t immediately affect a KDF (which relies on pre-image resistance), it does means you should clearly replace it with something stronger as soon as possible. SHA2-256, SHA2-512, SHA-3, BLAKE2 are all reasonable choices.

$\endgroup$
  • $\begingroup$ Hi, thanks for your answer. Yes, we are using X9.63 with SHA256. Is that fullfilling the "actually secure" assumption? $\endgroup$ – mike Sep 6 '18 at 6:55
  • $\begingroup$ Should be fine, although X9.63 is a bit “obscure” even if an ANSI standard specifically targeted at “financial services”. I work in security in the banking industry, and am only vaguely familiar with it. Everything I see points to various NIST or ISO standards. Getting past the “crypto must be FIPS-certified” thing is an industry-wide challenge. North American banks are awash in broken 1990s crypto because of this attitude. I’ll bet your bank’s website doesn’t support perfect forward secrecy for example. $\endgroup$ – rmalayter Sep 7 '18 at 13:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.