3
$\begingroup$

NIST 800-56Cr1 describes a single and two (extract-expand) step KDF designed for use in key agreement routines. NIST declares that HKDF (RFC5869) is a version of the two-step variation so test vectors can be found in the RFC. However I am not able to find test vectors for the former, one-step variation.

There are some for KBKDF (aka SP 800-108) in the Cryptographic Algorithm Validation Program, but not for 800-56C specifically. Can someone point me to the official or other test vectors?

Improve this question
$\endgroup$
5
  • $\begingroup$ Apologies, I thought you were seeking the test vectors for the HKDF in a single step, while the document defines (for a lack of a better word) a general construction of a different single step KDF that performs extraction and expansion in one atomic operation. This explanation to avoid similar answers. Personally I would avoid the construction altogether by the way. $\endgroup$
    – Maarten Bodewes ♦
    Nov 19, 2018 at 2:35
  • $\begingroup$ No worries. Id like to implement it as because Im interested in KDFs and half as an (personal) academic exercise (I think you learn a lot implementing specs). Its just super strange that they declare a family of KDFs and dont seem to care about somebody to be able to test them. $\endgroup$
    – Patrick
    Nov 19, 2018 at 13:20
  • 1
    $\begingroup$ As I indicated, somewhat abusively, I don't think that the persons in charge of handling KDF's are necessarily the most competent persons at NIST. I've had some discussions per email with one of them, and the person seemed entirely unphased by the fact that HSM's seemed to FIPS-certify different mechanisms, making them incompatible. This document seems to standardize an unnamed, half-arsed scheme based on original research. That you cannot create test vectors for half-defined schemes is just the final straw. $\endgroup$
    – Maarten Bodewes ♦
    Nov 19, 2018 at 13:57
  • 1
    $\begingroup$ One of the issues at NIST is that it seems to be focused on security rather than standardization. That results in the weird situation that they do not seem to standardize on any KDF - rather they describe each and every KDF that is considered secure. Since it is relatively easy to create a secure KDF given a secure PRF, they end up with oodles of schemes. So implementations based on NIST "standards" will likely be incompatible with each other, even on an API level. I propose renaming NIST crypto to National Institute for Security and Technology, because standardize they don't. $\endgroup$
    – Maarten Bodewes ♦
    Nov 19, 2018 at 14:01
  • $\begingroup$ It is indeed strange. Thanks for the entertaining insight Maarten :) $\endgroup$
    – Patrick
    Nov 19, 2018 at 14:42

2 Answers 2

Reset to default
1
$\begingroup$

Since as of now (2018) there seems to be no official test vectors, I generated some of may own. The whole list covering SHA1, SHA256, SHA512 and HMAC-SHA256/SHA512 can be found here: https://github.com/patrickfav/singlestep-kdf/wiki/NIST-SP-800-56C-Rev1:-Non-Official-Test-Vectors

Here is a snippet:

SHA-256

(z: afc4e154498d4770aa8365f6903dc83b, L: 16, fixedInfo: 662af20379b29d5ef813e655) = f0b80d6ae4c1e19e2105a37024e35dc6
(z: a3ce8d61d699ad150e196a7ab6736a63, L: 16, fixedInfo: ce5cd95a44ee83a8fb83f34c) = 5db3455a22b65edfcfde3da3e8d724cd
(z: a9723e56045f0847fdd9c1c78781c8b7, L: 16, fixedInfo: e69b6005b78f7d42d0a8ed2a) = ac3878b8cf357976f7fd8266923e1882
(z: a07a5e8df7ee1b2ce2a3d1348edfa8ab, L: 16, fixedInfo: e22a8ee34296dd39b56b31fb) = 70927d218b6d119268381e9930a4f256

(z: 3f892bd8b84dae64a782a35f6eaa8f00, L: 02, fixedInfo: ec3f1cd873d28858a58cc39e) = a7c0
(z: 3f892bd8b84dae64a782a35f6eaa8f00, L: 36, fixedInfo: ec3f1cd873d28858a58cc39e) = a7c0665298252531e0db37737a374651b368275f2048284d16a166c6d8a90a91a491c16f
(z: 3f892bd8b84dae64a782a35f6eaa8f00, L: 68, fixedInfo: ec3f1cd873d28858a58cc39e) = a7c0665298252531e0db37737a374651b368275f2048284d16a166c6d8a90a91a491c16f49641b9f516a03d9d6d0f4fe7b81ffdf1c816f40ecd74aed8eda2b8a3c714fa0

(z: 9ce5457e4a0eecc1c8709f7ef37a32e9, L: 16, fixedInfo: ) = 7d81e7d61acc06b90984ec4145469608

HMAC-SHA256

(z: 6ee6c00d70a6cd14bd5a4e8fcfec8386, L: 16, salt: 532f5131e0a2fecc722f87e5aa2062cb, fixedInfo: 861aa2886798231259bd0314) = 13479e9a91dd20fdd757d68ffe8869fb
(z: cb09b565de1ac27a50289b3704b93afd, L: 16, salt: d504c1c41a499481ce88695d18ae2e8f, fixedInfo: 5ed3768c2c7835943a789324) = f081c0255b0cae16edc6ce1d6c9d12bc
(z: 98f50345fd970639a1b7935f501e1d7c, L: 16, salt: 3691939461247e9f74382ae4ef629b17, fixedInfo: 6ddbdb1314663152c3ccc192) = 56f42183ed3e287298dbbecf143f51ac

(z: 02b40d33e3f685aeae677ac344eeaf77, L: 02, salt: 0ad52c9357c85e4781296a36ca72039c, fixedInfo: c67c389580128f18f6cf8592) = be32
(z: 02b40d33e3f685aeae677ac344eeaf77, L: 36, salt: 0ad52c9357c85e4781296a36ca72039c, fixedInfo: c67c389580128f18f6cf8592) = be32e7d306d891028be088f213f9f947c50420d9b5a12ca69818dd9995dedd8e6137c710
(z: 02b40d33e3f685aeae677ac344eeaf77, L: 68, salt: 0ad52c9357c85e4781296a36ca72039c, fixedInfo: c67c389580128f18f6cf8592) = be32e7d306d891028be088f213f9f947c50420d9b5a12ca69818dd9995dedd8e6137c7104d67f2ca90915dda0ab68af2f355b904f9eb0388b5b7fe193c9546d45849133d

(z: 2c2438b6321fed7a9eac200b91b3ac30, L: 56, salt: 6199187690823def2037e0632577c6b1, fixedInfo: ) = b402fda16e1c2719263be82158972c9080a7bafcbe0a3a6ede3504a3d5c8c0c0e00fe7e5f6bb3afdfa4d661b8fbe4bd7b950cfe0b2443bbd
(z: 0ffa4c40a822f6e3d86053aefe738eac, L: 64, salt: 6199187690823def2037e0632577c6b1, fixedInfo: ) = 0486d589aa71a603c09120fb76eeab3293eee2dc36a91b23eb954d6703ade8a7b660d920c5a6f7bf3898d0e81fbad3a680b74b33680e0cc6a16aa616d078b256
(z: a801d997ed539ae9aa05d17871eb7fab, L: 08, fixedInfo: 03697296e42a6fdbdb24b3ec) = 1a5efa3aca87c1f4
(z: e9624e112f9e90e7bf8a749cf37d920c, L: 16, fixedInfo: 03697296e42a6fdbdb24b3ec) = ee93ca3986cc43516ae4e29fd7a90ef1
Improve this answer
$\endgroup$
1
$\begingroup$

I realize that this question is a bit old, but all of the "Key Management" test vectors provided by NIST here: https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines/example-values use the Single-Step KDF to generate the expected key data. They refer to it as the "Concatenation KDF" which might have been an early name for the Single-Step KDF. Also, the "Concatenation KDF" uses Hash() as the auxiliary function. So, these test vectors do you no good for testing your HMAC version of the Single-Step KDF. I am not aware of any official test vectors for the HMAC Single-Step KDF.

If all you want to test is the KDF itself, you can skip all the "Key Agreement Scheme" parts of these test vectors and just use the shared secret Z that is shown as the input to your KDF.

Sorry this answer is so late. Good luck!

Improve this answer
$\endgroup$
1
  • $\begingroup$ Okay, the name "Concatenation KDF" is in fact defined by NIST. Here is a snippet from SP-800-56Ar2 para 5.8.1.2.1: Note: When the single-step KDF specified in Section 5.8.1.1 is used with H = hash as the auxiliary function and this concatenation format for OtherInfo, the resulting key-derivation method is the Concatenation Key Derivation Function specified in the original version of SP 800-56A. $\endgroup$
    – Mark Wagner
    Oct 25, 2022 at 16:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.