1
$\begingroup$

enter image description here

This is from Dan Boneh's Coursera Lectures - Week 6 - Constructions. https://www.coursera.org/learn/crypto/lecture/nTRhL/constructions

Here he picks a random x from X. And then Hashes X to get the session key k from K
k = H(x).

Why not just pick a random k from K instead of first picking x from X & then hashing it to get k? What is the necessity of the Hashing function here?

Improve this question
$\endgroup$
4
  • $\begingroup$ @kelalaka - What is the problem if it's used both in F & E? $\endgroup$
    – user93353
    Jan 26, 2021 at 7:18
  • $\begingroup$ Sorry I've misread the eq. This is like RSA-KEM. One reason, the key is needed to be larger than the required and $F$ may not be secure sending small keys directly as RSA ( you need padding). Whereas RSA-KEM can be used without padding and the all key material should be used with KDF ( better than hashing, or see KDF-1 poormans KDF) $\endgroup$
    – kelalaka
    Jan 26, 2021 at 7:24
  • $\begingroup$ I guess it plays a role only in the security reduction, where modelling the hash as a random oracle (and programming it) is key. $\endgroup$
    – ckamath
    Jan 26, 2021 at 8:00
  • $\begingroup$ Suppose you pick a random k: what do you do with y then? Do you set y to F(pk,k) directly? I'd suggest you try it and go through the security analysis to see why it's not clear anymore how to prove security of the resulting scheme. $\endgroup$
    – Geoffroy Couteau
    Jan 27, 2021 at 21:52

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.