# KDF for generating RSA and ECC keys from a 2048 bit secret

Do KDFs exist for generating RSA and ECC keys from a 2048-bit random secret?

• Not a clear question. What is the 2048 bit symmetric key? We usually have 128,192,256 bits in symmetric key cryptography. For RSA, one needs to find random primes to form the modulus, etc. For ECC, one needs secret random. Usually. we use the reverse (hybrid-cryptosystem) since we can exchange/establish keys with public-key cryptography like DHKE, ECDH,RSA-KEM and use the KDF to derive a symmetric key and IV/nonce. What is your actual use case? – kelalaka Jun 16 '20 at 7:46
• Please do follow up on your questions. Try and accept answers or indicate why the given answers are not clear. And if clarification is asked, please provide it. – Maarten Bodewes Jun 30 '20 at 22:38

## 1 Answer

Rather no. There is no standard construction going by the name Key Derivation Function aimed at generating public/private key pairs. Traditionally, especially for RSA, how to generate a key pair is left at the discretion of the implementation, rather than made per a specific deterministic process. The usual name is Key Generation. And it's usually stated as a randomized algorithm, rather than as a function.

For ECC per Sec1, it is straightforward to define such KDF. The private key is an integer $$d$$ in range $$[1,n-1]$$ where $$n$$ is the fixed, public order of a generator on a curve. Thus we could take the 2048-bit secret¹ $$s$$, and turn it to the private key by applying $$d\gets(s\bmod(n-1))+1$$; then compute the public key by applying $$Q\gets d\,G$$ using point multiplication. Since in practice $$n\le2^{800}$$, the bias on $$d$$ is negligible if the 2048-bit $$s$$ is uniformly random.

For RSA, that's less easy. We need to specify a Cryptographically Secure Pseudo-Random Number Generator, seed it with the 2048-bit secret¹ $$s$$, and generate the RSA key per some precisely agreed-upon process. FIPS 186-4 appendix B.3.2 is next to being precise enough. Also, beware that it is hard to secure such computations from side-channel and fault attacks.

¹ Or a derivative $$s$$ of that secret by a symmetric KDF.