I need to use a hash function to generate a 128-bit key for a symmetric cipher. The specific cipher is from the eStream portofolio, called Rabbit.

I am using the SRP protocol for authentication (a type of EKE protocol). As a result of this, both parties will calculate the same large integer value and need to hash it into a key they can both use.

I would like to use SHA256 to generate the key, but its output is twice the length required.

Can I just truncate the hash to the lower 128 bits or something?

What is usually done in this case?

  • $\begingroup$ I've just seen another poster ask about the RIPEMD hash functions - I believe there is a 128-bit version. Would anyone recommend using this instead of a SHA2 function in this case? :) $\endgroup$
    – James
    Commented Oct 13, 2011 at 11:48
  • $\begingroup$ Why not just use a PRNG? $\endgroup$ Commented Oct 13, 2011 at 12:54

2 Answers 2


Short answer: just truncate, it's fine.

Long answer: you want a Key Derivation Function. A KDF turns an arbitrary-sized input (the shared secret obtained from SRP) into a configurable sequence of bytes, which you can split into as many sub-sequences as you need for symmetric cryptography. For instance, SSL/TLS defines a KDF (it calls it "PRF"; see section 5) so that it can extend the "master secret" (the shared secret obtained from whatever key exchange mechanism has been used) into six elements (an encryption key, a MAC key, and an IV, for each tunnel direction).

If you have a "reasonable" hash function such as SHA-256, and your secret data needs an amount of at most the hash output length, then a simple truncation will be an appropriate KDF. (Theoretically, being a good KDF after truncation is not implied by the hash function being appropriately resistant to collisions and preimages, but in practice you will not get any trouble with SHA-256 or SHA-512.)


You should have a look at PKCS#5 (aka RFC2898). Many frameworks (e.g. .NET) will provide you with the classes to use them (prefer the later, v2, one if available).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.