Assume a 256-bit Key and a 256-bit Salt, with uniformly distributed entropy, both fully independent.

Assume Key is secret and Salt is public.

What theoretical advantages would deriving an AES-256-CTR encryption key using Key XOR Salt give to an attacker?

Assume that the product of Key XOR Salt will remain secret.

Assume that a KDF such as HKDF or a PRF such as HMAC cannot be used.

  • 1
    $\begingroup$ I've deleted my question since it appears I've misunderstood you. Can you explain what exactly you want to accomplish? You don't need a salt if you already have a fully random secret key. Just XORing a key with a public value is pointless since you can XOR it with the public value again to obtain the secret key. $\endgroup$ – forest Nov 28 '18 at 10:09
  • $\begingroup$ The question concerns the theoretical advantages that deriving an AES-256-CTR encryption key using Key XOR Salt would give to an attacker. It's theoretical, and again, it assumes that the product of the XOR remains secret, i.e. the obvious XOR round-trip is not available to an attacker. $\endgroup$ – Joran Greef Nov 28 '18 at 10:25
  • 2
    $\begingroup$ Well it's pretty contrived, but there would certainly be no security issue as long as the two values are independent. I think you should change "salt" to something else though, since that value is not being used as a salt. I'm not sure what to call it. Maybe just "public value"? $\endgroup$ – forest Nov 28 '18 at 10:26
  • 1
    $\begingroup$ Since they are independent, there's no way an attacker could intelligently influence the resulting key, which means naturally it cannot possibly give them a cryptographic advantage. $\endgroup$ – forest Nov 28 '18 at 10:32

The two main concerns I'd have with the scheme you describe are 1) the risk of one of the subkeys being compromised, and 2) related-key attacks on the cipher.

The first concern is obvious: since the XOR operation is reversible, if an attacker finds out any one of the subkeys and knows the corresponding salt, then they can recover the master key.

Of course, if you can guarantee that all the subkeys are just as well protected as the master key, then this may be a non-issue. But an extra layer of safety in case of subkey compromise can still be a nice thing to have, and using a non-reversible key derivation function instead of just XOR provides it at a very low cost.

The second concern is a bit harder to quantify. There are known related-key attacks against AES, but so far none of them are efficient enough to be a real threat in practice. Still, they do demonstrate that AES does not necessarily deliver its full advertised level of security in situations where an attacker may know the XOR of two or more keys.

As before, assuming that no new and significantly better related-key attacks against AES are found, you might be able to get away with this in practice. (We do need to make some assumption like that anyway, given that nobody has proven AES to be secure, with or without related keys.) But again, the safe and conservative choice would be to use a proper key derivation function that does not reveal any mathematical relationship between the subkeys.

  • $\begingroup$ Is the question about the key schedule? $\endgroup$ – forest Nov 30 '18 at 8:09

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.