# KDF for generating RSA and ECC keys from a 2048 bit secret

Do KDFs exist for generating RSA and ECC keys from a 2048-bit random secret?

• Not a clear question. What is the 2048 bit symmetric key? We usually have 128,192,256 bits in symmetric key cryptography. For RSA, one needs to find random primes to form the modulus, etc. For ECC, one needs secret random. Usually. we use the reverse (hybrid-cryptosystem) since we can exchange/establish keys with public-key cryptography like DHKE, ECDH,RSA-KEM and use the KDF to derive a symmetric key and IV/nonce. What is your actual use case? – kelalaka Jun 16 '20 at 7:46
For ECC per Sec1, it is straightforward to define such KDF. The private key is an integer $$d$$ in range $$[1,n-1]$$ where $$n$$ is the fixed, public order of a generator on a curve. Thus we could take the 2048-bit secret¹ $$s$$, and turn it to the private key by applying $$d\gets(s\bmod(n-1))+1$$; then compute the public key by applying $$Q\gets d\,G$$ using point multiplication. Since in practice $$n\le2^{800}$$, the bias on $$d$$ is negligible if the 2048-bit $$s$$ is uniformly random.
For RSA, that's less easy. We need to specify a Cryptographically Secure Pseudo-Random Number Generator, seed it with the 2048-bit secret¹ $$s$$, and generate the RSA key per some precisely agreed-upon process. FIPS 186-4 appendix B.3.2 is next to being precise enough. Also, beware that it is hard to secure such computations from side-channel and fault attacks.
¹ Or a derivative $$s$$ of that secret by a symmetric KDF.