Do KDFs exist for generating RSA and ECC keys from a 2048-bit random secret?

  • 4
    $\begingroup$ Not a clear question. What is the 2048 bit symmetric key? We usually have 128,192,256 bits in symmetric key cryptography. For RSA, one needs to find random primes to form the modulus, etc. For ECC, one needs secret random. Usually. we use the reverse (hybrid-cryptosystem) since we can exchange/establish keys with public-key cryptography like DHKE, ECDH,RSA-KEM and use the KDF to derive a symmetric key and IV/nonce. What is your actual use case? $\endgroup$ – kelalaka Jun 16 at 7:46
  • $\begingroup$ Please do follow up on your questions. Try and accept answers or indicate why the given answers are not clear. And if clarification is asked, please provide it. $\endgroup$ – Maarten Bodewes Jun 30 at 22:38

Rather no. There is no standard construction going by the name Key Derivation Function aimed at generating public/private key pairs. Traditionally, especially for RSA, how to generate a key pair is left at the discretion of the implementation, rather than made per a specific deterministic process. The usual name is Key Generation. And it's usually stated as a randomized algorithm, rather than as a function.

For ECC per Sec1, it is straightforward to define such KDF. The private key is an integer $d$ in range $[1,n-1]$ where $n$ is the fixed, public order of a generator on a curve. Thus we could take the 2048-bit secret¹ $s$, and turn it to the private key by applying $d\gets(s\bmod(n-1))+1$; then compute the public key by applying $Q\gets d\,G$ using point multiplication. Since in practice $n\le2^{800}$, the bias on $d$ is negligible if the 2048-bit $s$ is uniformly random.

For RSA, that's less easy. We need to specify a Cryptographically Secure Pseudo-Random Number Generator, seed it with the 2048-bit secret¹ $s$, and generate the RSA key per some precisely agreed-upon process. FIPS 186-4 appendix B.3.2 is next to being precise enough. Also, beware that it is hard to secure such computations from side-channel and fault attacks.

¹ Or a derivative $s$ of that secret by a symmetric KDF.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.