3
$\begingroup$

In schemes like SAKE(Symmetric-key Authenticated Key Exchange) , the master keys (used to authenticate parties and generate session keys) are evolving, ie undergo transition $K=update(K)$.

  • What is a good candidate for $update(.)$ function?

  • Would $K=\operatorname{AES}(K, S)$ have "good properties", with $S$ being arbitrary block-length constant?Author of the algorithm state that $update(.)$ should be irreversible function.

Improve this question
$\endgroup$
2
$\begingroup$

AES is not irreversible, at least not when the key is known. I'd rather look at a PRF (Pseudo Random Function) rather than a PRP (Pseudo Random Permutation) such as AES.

A good PRF is HMAC. HMAC also has the nice properties of having no limit to the input message and a rather large, although statically sized output.

Even more specifically you might want to use a Key Based Key Derivation Function (KBKDF) such as HKDF - which is based on HMAC. A HKDF specifically takes input keying material to create output keying material.

It might be that KDF functions are e.g. present in hardware devices. This means that they keying material could stay into the hardware device, while ciphertext or HMAC values are commonly exported.

Improve this answer
$\endgroup$
  • $\begingroup$ Maybe my notation was not clear. By $K_{new}=AES(K_{old}, S)$ I mean encrypting by AES using $K_{old}$ in the role of a key and arbitrary constant block $S$ in the role of an input block. Is this usage of AES reversible, i.e. is it possible to retrieve the old key from knowing the new one ? The reason I ask it because I implement it on STM32 MCU where the only HW accelerated algo is AES. It goes without saying that CPU is limited here, and taking advantage of HW acceleration is hugely beneficial. $\endgroup$ – Rachotilko Aug 3 '20 at 10:20
  • 1
    $\begingroup$ I'd rather use AES-CMAC in that case, also a PRF, although a software based HMAC might also be a secure option. Of course getting the old key from the new one would not be possible. However, getting $S$ using both keys is. $\endgroup$ – Maarten Bodewes♦ Aug 3 '20 at 10:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.