This is a quote from my cryptography notes:

If $h$ is a random function oracle of output length $n$ then also the two KDF constructions:

$K(x) = h([0] \| x) \ldots \| h([L] \| x)$

$K(x) = h(x \| [0] ) \ldots \| h(x \| [L])$

yield random function oracles of otput length $L \cdot n$.

They call this property domain separation. What does this property mean? Can it be applied to only this setting or is it more general? What about the proof of this quote, is it inmediate?


1 Answer 1


With KDFs, you need domain separation when you use the same initial key material to generate keys for different purposes like using the same initial key material and nonce to generate encryption and signing keys, you provide the KDF some data about the domain (encryption or signing) so it can generate different (private) keys. eg. for HKDF there is an info parameter that can be used for domain separation, see here.

Domain separation is a broader concept and also applies when the same hash function for hashing different kinds of data in a system, so if you wanted to hash say user id and user account balance using the same hash function, you will use different domain separators like user-id (assuming user-id is numeric) and user-bal. Another common example is hashing leaves and non-leaves in a Merkle tree, see here for more details.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.