2
$\begingroup$

This is a quote from my cryptography notes:

If $h$ is a random function oracle of output length $n$ then also the two KDF constructions:

$K(x) = h([0] \| x) \ldots \| h([L] \| x)$

$K(x) = h(x \| [0] ) \ldots \| h(x \| [L])$

yield random function oracles of otput length $L \cdot n$.

They call this property domain separation. What does this property mean? Can it be applied to only this setting or is it more general? What about the proof of this quote, is it inmediate?

$\endgroup$
  • $\begingroup$ Anything missing from the given answer Javier? It seems like a pretty conclusive answer from my viewpoint, but it hasn't been accepted. $\endgroup$ – Maarten Bodewes Feb 14 at 16:27
4
$\begingroup$

With KDFs, you need domain separation when you use the same initial key material to generate keys for different purposes like using the same initial key material and nonce to generate encryption and signing keys, you provide the KDF some data about the domain (encryption or signing) so it can generate different (private) keys. eg. for HKDF there is an info parameter that can be used for domain separation, see here.

Domain separation is a broader concept and also applies when the same hash function for hashing different kinds of data in a system, so if you wanted to hash say user id and user account balance using the same hash function, you will use different domain separators like user-id (assuming user-id is numeric) and user-bal. Another common example is hashing leaves and non-leaves in a Merkle tree, see here for more details.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.