1
$\begingroup$

Say I want to generate a deterministic private key related to some data, for instance to a domain name. The easiest way I can think of is:

  1. take a secret material which will work as "generator".
  2. take a domain name and HMAC-SHA256(my secret, domain name).
  3. take resulting hash and use it directly as secp256k1 private key.

Question is if that last step is an OK move or are there issues with directly using hash as private key?

Improve this question
$\endgroup$
3
  • $\begingroup$ Simple rule of thumb is that the transformation process doesn't matter, the entropy source does. $\endgroup$
    – DannyNiu
    Sep 12, 2020 at 5:21
  • $\begingroup$ @DannyNiu I might add the caveat that if one key is compromised, the transformation method matters very much since you don't want one compromised key leading to the rest of them. But SHA-256 is perfectly good as a transformation method, so in this case OP should be fine. $\endgroup$
    – Serpent27
    Sep 12, 2020 at 6:12
  • $\begingroup$ What happened to good random source for the key generation? Still you need a key for HMAC that need to be secure. Your input is already known. $\endgroup$
    – kelalaka
    Sep 12, 2020 at 8:23

1 Answer 1

Reset to default
3
$\begingroup$

If your secret material (you call this my secret so I'll use that name) is chosen with sufficient min-entropy, then yes this scheme is acceptable. my secret, however, must be in itself sufficiently hard to guess; it becomes effectively a password cracking problem. As such, I would suggest my secret be a randomly generated keyfile, or at least a really secure password.

It's worth noting that if my secret is found, this system completely fails. So guard my secret very well. Be wary of keyloggers, shoulder surfers, malware, people nearby who happen to have a parabolic microphone (I'm not kidding), suspicious power outlets (also not kidding), and any number of other attack vectors.

Also, the benefit of a randomly generated key is, in the event of a compromise, you only need to change the key that gets compromised (or keys if multiple get compromised). In your deterministic case you have a single point of failure for the entire system, which according to Happy Quinn is not good (let's see if you can guess what I'm referencing).

Improve this answer
$\endgroup$
1
  • 1
    $\begingroup$ It is worth to add that the probability is $<2^{-127}$ that a random HMAC-SHA-256 result accidentally falls out of the range $[1,2^{256}-\mathtt{14551231950b75fc4402da1732fc9bebf_h})$ of valid secp256k1 private keys; and that it seems infeasible to exhibit an example of the contrary. $\endgroup$
    – fgrieu ♦
    Sep 12, 2020 at 9:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.