Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
This is a quote from my cryptography notes:
If $h$ is a random function oracle of output length $n$ then also the two KDF constructions:
$K(x) = h([0] \| x) \ldots \| h([L] \| x)$
$K(x) = h(x \| [0] ) \ldots \| h(x \| [L])$
yield random function oracles of otput length $L \cdot n$.
They call this property domain separation. What does this property mean? Can it be applied to only this setting or is it more general? What about the proof of this quote, is it inmediate?
With KDFs, you need domain separation when you use the same initial key material to generate keys for different purposes like using the same initial key material and nonce to generate encryption and signing keys, you provide the KDF some data about the domain (encryption or signing) so it can generate different (private) keys. eg. for HKDF there is an info parameter that can be used for domain separation, see here.
Domain separation is a broader concept and also applies when the same hash function for hashing different kinds of data in a system, so if you wanted to hash say user id and user account balance using the same hash function, you will use different domain separators like user-id (assuming user-id is numeric) and user-bal. Another common example is hashing leaves and non-leaves in a Merkle tree, see here for more details.
