6
$\begingroup$

Assume for the sake of the question that I have two variable-length bit strings, each with 128 bit cryptographic randomness, and I want to extract two 128 bit keys via HKDF-SHA256.

Which alternative is better (if any), and why?

  1. Use a single HKDF-extract on the concatenation of the two strings, and two HKDF-expands with different info strings to get two 128 bit keys.
  2. Use two HKDF-extract operations, one for each bit string, and use a single HKDF-expand on each to get two 128 bit keys.

Or in other words, is it better to HKDF-extract on a longer IKM string and use multiple HKDF-expands, or is it better to use HKDF on independent but shorter IKMs.

My intuition tells me that, if my randomness strings are really as good as I claim, then two independent HKDF extracts are better, but using a single one on the concatenation is, in practice, just as safe, and safer if my input randomness is not actually as good as assumed, so two HKDFs might be more robust in practice.

Improve this question
$\endgroup$
7
  • $\begingroup$ there's also a third option: similar to the first option, but expand once and request 256 bits of output, and split the output to make two keys $\endgroup$
    – hunter
    Jul 19, 2013 at 12:14
  • 2
    $\begingroup$ The HKDF RFC stresses that different keys should use different info strings, so while that option exists, it's probably a weaker variant of a). $\endgroup$
    – Marc Lehmann
    Jul 19, 2013 at 13:03
  • $\begingroup$ @MarcLehmann I deleted my answer because you said that your bitstrings contain 128 bit randomness. In that case a KDF is appropriate and should be used, You confused me however by saying that your bitstrings are 128 bit cryptographic randomness, which in my book would mean that an attacker can not accurately predict the next bit of randomness given all previous bits in less than $2^{128}$ time. $\endgroup$
    – orlp
    Jul 19, 2013 at 19:26
  • 2
    $\begingroup$ I never said they are 128 bit randomness, I explicitly wrote the strings are variable-length. Also, your answer was wrong even if your assumption would have been true: Your claim that the purpose of KDFs is to expand small keyspaces and increase brute force costs linearly is simply wrong. It's correct for PBKDFs, though, as I remarked to you. $\endgroup$
    – Marc Lehmann
    Jul 19, 2013 at 19:43
  • $\begingroup$ @hunter: note the "probably", i.e., I just guess. Expanding to 256 bit and splitting might be completely equivalent - what I tried to say is that I see it as a variant of a), as only one extract operation is done. $\endgroup$
    – Marc Lehmann
    Jul 19, 2013 at 19:45

1 Answer 1

Reset to default
1
$\begingroup$

Realistically, it probably doesn't matter, if all of your premises are accurate.

If it were me, I'd probably concatenate the inputs, then apply a HKDF to the concatenation to derive two keys -- but honestly, it's unlikely to matter. This is very unlikely to be the weakest link in your system. Pick something that's easy to implement and easy to understand, and move on: focus your energy on some other aspect of your system.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.