I want to generate a random number using DRBG with below follow: Entropy source -> DRBG -> PBKDF
adding PBKDF is redundant ?
2 Answers
$\begingroup$
$\endgroup$
3
A PBKDF is a password-based key derivation function. The output of a DRBG is NOT a password.
A DRBG's output could be used as an input to a key derivation function, if (and only if) that DRBG is cryptographically secure (AKA a CSPRNG). For example RSA requires picking two large prime numbers randomly, and CSPRNGs are used to supply data for RSA KDFs.
It's often useless to use a standard KDF to generate symmetric keys based on the output of a DRBG. If the DRBG isn't a CSPRNG, the output isn't secure. If it is, the KDF is unnecessary, one could just generate more bits! The exception is with "ratcheting" schemes where a KDF is used on a previous key and some other data to derive the next key key. The first key in the sequence might have been generated with the use of a CSPRNG.
-
$\begingroup$ I agree mostly, but generating a master secret (using a DRBG) and then deriving additional keys using a KBKDF would be a fine practice. $\endgroup$– Maarten Bodewes ♦Commented Feb 24, 2022 at 15:37
-
$\begingroup$ Agreed. I try to get at this with the last paragraph: it's not generally necessary, but it can be useful, particularly for ratchet schemes. $\endgroup$ Commented Feb 24, 2022 at 19:35
-
1$\begingroup$ I could also see it useful if there are multiple ways that a master secret can be formed, not just generation using a PRNG. $\endgroup$– Maarten Bodewes ♦Commented Feb 24, 2022 at 23:23
$\begingroup$
$\endgroup$
2
I assume you use a secure DRBG.
If you have little entropy, e.g. 8 bits per request, then the results of DRBG will be easily predictable. Knowing a few values previous numbers can allow to predict further numbers.
Applying PBKDF does not help. And for PBKDF (if you mean PBKDF2, Argon, Makwa, scrypt etc.) you will normally need further random number, means you will need further entropy. Better is to us this entropy in DRBG directly.
If DRBG is secure and accepts sufficiently long input/seed, collect sufficient entropy, e.g. 128 bit, and use pure DRBG.
answered Jan 25, 2022 at 6:40
-
$\begingroup$ Yes, entropy source are from TRNG and use secure DRBG. $\endgroup$– AndyCommented Jan 25, 2022 at 7:13
-
1$\begingroup$ @Andy: Then just collect sufficient entropy (depending on what you consider secure for your purpose, e.g. 128 bit), and use pure DRBG. $\endgroup$ Commented Jan 25, 2022 at 7:34