I'm a newbie to cryptography and I have been wondering about the possibility of using Chameleon hashes as symmetric encryption keys. Here is my scenario and my thought process:

Let us consider a server with multiple resource constrained clients (for example fitness band). I want each client to have a unique and secure symmetric encryption key to communicate with the server and I want them to dynamically be able to refresh their keys with the least amount of communication over the unsecure channel.

Let us assume I have a fully trusted gateway (which I assume is secure) between the client and server that can find Chameleon collisions for me. The client has a value $m1$ (for example its UUID) and the server stores another value $m2$ (its UUID for example). The gateway knows these two UUIDs ($m1$ and $m2$). It generates 2 random numbers using a CSPRNG: $rand_1$, $rand_2$ and one time Pads it with the $m1$ and $m2$. Gateway shares $rand_1$ to client and $rand_2$ to server. So new value $m1'$ for client will be $m1 \oplus rand_1$ and new value $m2'$ for the server will be $m2 \oplus rand_2$. The gateway also generates two more random nummbers $r_1, r_2$ using CSPRNG such that $\text{CHAM}(m1',hashkey,r1) = \text{CHAM}(m2',hashkey,r2) =$ shared new encryption key between client and server. Gateway also shares $r_1$ with client and $r_2$ with servers so that the client and server can calculate the keys and use it going forward.

Since Chameleon hashes are collision resistant, this will give me unique keys for each client. An attacker cannot guess the encryption keys even if he knows the UUIDs since we are 1) XORing with a random number for entropy 2) using $r_1$ in our hash function during every refresh. I am not sure about the entropy of the resulting hash to know if the keys will be totally random but I read that the resulting hash of two different messages is uniformly distributed for a given random number $r$ ($\text{CHAM}(m1, hashkey, r$) and $\text{CHAM}(m_2, hash key, r)$.

I am not sure what security properties and requirements of a secure encryption key will stop us from using resulting chameleon hashes a bad choice for dynamic symmetric encryption key generation. I would really appreciate if someone can help me with this.

  • $\begingroup$ If you have a trusted gateway, and the trusted gateway can securely deliver the key material to the parties, surely you can let the gateway to generate the shared keys (in fact in your protocol the shared the key is already generated by the gateway by finding the collision) and deliver it to the parties securely. It is more efficient and much simpler. $\endgroup$ – Changyu Dong Feb 14 at 9:34
  • $\begingroup$ @ChangyuDong : Thanks .. Do you think there is any property of the resulting chameleon hash that does not meet the requirements of a encryption key ? $\endgroup$ – shrram Feb 14 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.