Questions tagged [hkdf]
HKDF is a key derivation function specified in RFC5869.
124 questions
0
votes
0
answers
45
views
Is it possible to perform a "KDF flooding" attack to exhaust all contexts c of a KDF and make it unusable?
I'm actually working on KDF (Key Derivation Function) and specificialy on the HKDF paper from CRYPTO-2010.
Let's consider the following HKDF oracle : $KDF(\sigma, r, c, l)$ where :
$\sigma$ : Raw ...
- 1
5
votes
1
answer
338
views
Risks of using SHA256 for key derivation
I'm working on a project where I need to derive several child keys from a parent key. I'm not a cryptography expert, so I'd really appreciate a simple explanation to help me understand the best ...
2
votes
1
answer
166
views
TLS 1.3 key derivation and length of labels used (RFC 8446)
Out of sheer curiosity, I've been referring to RFC 8446 and implementing a TLS 1.3 client. I've implemented traffic key derivation as described in section 7.1 of the RFC.
There is a note in the last ...
- 35
1
vote
0
answers
66
views
Is it a good idea to create ECDH private keys with HKDF of random data and shared secret?
I'm using ECDH (X25519 or X448) between two parties that already have a shared secret. Because of the shared secret, I don't need any public key signatures to prevent man-in-the-middle attacks, ...
- 1,623
2
votes
2
answers
164
views
Is the quality of hash function essential in HKDF?
Hash functions have a number of properties needed, including the property that no collisions must be able to be found. Generally, if we can find collisions for hash functions, we consider the hash ...
- 1,623
1
vote
0
answers
135
views
Best way of using AES GCM with static key PBKDF2/HKDF
Refering to this thread : using different IV and SALT with AES-CBC but same KEY
I am in a similar situation to the one exposed, namely that I need to use AES to encrypt data, however, I cannot ...
- 31
0
votes
1
answer
148
views
Row level database encryption scheme
I am developing a row level database encryption scheme. Ideally I would not do this and instead rely on something vetted, but I haven't been able to find such a scheme online.
My primary concerns are:
...
- 1
1
vote
0
answers
96
views
How to correctly use .NET's HKDF key derivation APIs to generate two keys for AES-256-CBC HMAC-SHA256 encryption
I have a 32-byte cryptographic key generated using .NET's cryptographic random number generator, and I'd like to use it as the key material to generate two other keys per user in my web application.
...
- 111
1
vote
1
answer
71
views
Using parts of the master seed as the salt for HKDF
Does using a portion of a master seed, such as the last 12 bytes of a 128-byte random master seed, as a salt provide any additional security to the HKDF when deriving child seeds? Alternatively, is it ...
- 59
2
votes
1
answer
667
views
What is the correct way to use HKDF with X25519?
I am trying to implement ECIES properly with X25519/HKDFwithSHA256/AES-128-GCM with Node.js crypto library. It is not clear to me how to determine the input key material (IKM) to HKDF.
Initially, I ...
- 31
2
votes
0
answers
40
views
ZKP of knowledge of EC keys preimage
There is a random scalar seed $s$ which we may call a master secret.
There are 2 public strings or scalars: $m1, m2$ and 2 corresponding EC keypairs: $a, A=a*G$ and $b, B=b*G$
$a$ and $b$ are somehow ...
- 149
3
votes
1
answer
61
views
It is correct to concatenate HKDF expand stages?
I want to derive session keys for many clients from a Master Key. Suppose I derive a key for the client $n$ in the following way:
master_key = HKDF-extract(salt, IKM)
key_client_n = HKDF-expand(...
3
votes
1
answer
352
views
Is the output of HKDF uniformly distributed, if my input is not?
I have done some research on HKDF but I am still not sure about the security properties in different scenarios.
Which properties are fullfilled, when IKM and the salt are random and secret, but not ...
- 308
4
votes
0
answers
45
views
What is the impact of leaving a salt used in HKDF open to attacker control? [duplicate]
RFC 5869 for HKDF says "an application needs to make sure that salt values are not chosen or manipulated by an attacker".1 Soatok also discusses some nuances in choosing salts for HKDF.2 ...
2
votes
0
answers
98
views
How are the `binder hash` and `finished` values calculated in the Resumed 0-RTT Handshake example in TLS 1.3?
I'm trying to understand the implication of the Binder Keys in in a TLS 1.3 resumed handshake. The TLS 1.3 RFC provides an additional RFC with example traces to validate all the math in a TLS 1.3 ...
- 993
1
vote
0
answers
168
views
Wrap AES 256bit key with Argon2 without losing entropy
Given a random 256bit key used for data encryption with Streaming AES GCM
I would like to wrap it for backup with AES GCM.
Is it safe to use
...
- 123
1
vote
1
answer
168
views
Should the cSHAKE customization string ever be attacker-controlled?
On first glance, the optional customization string for cSHAKE resembles the optional salt input to HKDF-Extract. Indeed, the Noise Protocol Framework initially uses a protocol identifier string as its ...
- 557
1
vote
1
answer
511
views
HKDF-Expand max output length
I'm trying to use HKDF-Expand to derive lots of keying material (> 64GB) from a pseudo-random 512 bit key.
Now according to the HKDF RFC, the maximum amount of ...
- 13
3
votes
1
answer
292
views
In TLS 1.3, is the first Derived Secret always a constant value (in non-PSK handshakes)?
RFC 5869 Defines HKDF-Extract in section 2.2 as:
HKDF-Extract(salt, IKM) -> PRK
TLS 1.3 RFC 8446 defines the first part of the Key Schedule like this:
...
- 993
3
votes
2
answers
1k
views
3
votes
0
answers
157
views
Does NIST SP800-56C r2 forbid using NIST-approved two-step KDFs for not-all-at-once key-derivations?
NIST SP800-56C r2 added Section 5.3 which specifically addresses using a single Extract step followed by ...
- 43
0
votes
1
answer
181
views
Can salt for HKDF be hardcoded within a program
i am new to cryptography , i am using article https://medium.com/asecuritysite-when-bob-met-alice/hmac-and-hkdf-df4e194752d1 for reference , while using salt with hkdf to derive multiple keys from a ...
- 1
1
vote
1
answer
474
views
to derive multiple keys from single shared secret can i safely ignore info and salt parameter in HKDF
I am using a PQ-KEM to get a 32 byte shared secret. I want to derive 2 keys , 1 for encryption of message using AES-CTR and another for HMAC-512. can I safely ignore salt and info parameter in hkdf-...
0
votes
1
answer
70
views
If attacker modifies salt used for HKDF used for splitting keys for encryption and authentication will cryptosystem be safe?
I have 16 byte shared secret , I am using HKDF-SHA256 to derive 2 ,32 byte keys , one for encryption aes256-gcm and another hmac-256 , the salt info used for HKDF are sent publicly along with the ...
1
vote
1
answer
687
views
Minimum length of salt and info for HKDF
Hi newbie here is there any minimum length for salt and info passed to hkdf based key derivation or is using 32 byte randomly generated bits for salt and info can be used for all hkdf
1
vote
1
answer
170
views
HKDF IKM length requirements?
I read through RFC5869 and I didn't see any recommended or required octet length of the IKM used in the HKDF-Extract operation. Is there any relationship between the Hash method used in the HKDF-...
- 113
1
vote
1
answer
169
views
Use of HKDF to get shorter key than digest size
Is OK to derive a key using HKDF (Extract & expand) with a shorter size than the digest size of the configured hash function? In that case the result is computed (on the expand part) by truncating ...
- 195
1
vote
2
answers
350
views
Why does the RFC version of HKDF-Expand start the counter at 1?
In RFC 5869, the definition of HKDF-Expand is given as follows, with the terminating counter value ranging from 1 to (presumably) 255:
...
- 557
1
vote
1
answer
421
views
Does deriving a key from a master key and then encrypting with AES-GCM increase the lifetime of the master key?
Suppose that we have a symmetric 256-bit master key, and we want to encrypt using AES-GCM with random IVs. I understand that with random IVs, the lifetime of the master key is 2^32 in order to conform ...
- 11
2
votes
1
answer
1k
views
How is TLS 1.3 application data encrypted with AES-GCM sent 'over the wire'?
I've been trying to manually decrypt some TLS 1.3 traffic for educational reasons, and have stumbled across a roadblock. So far, I've been able to complete most of the key schedule, including deriving ...
- 161
1
vote
1
answer
593
views
Do I need a salt when deriving new keys with HKDF if master key is strong? Is a global salt ok?
Let's say I have a master key and want to use it to derive new keys to use for encryption, using HKDF. I'm a bit confused regarding the use of salt though. I have seen other posts about it here but I ...
- 111
0
votes
0
answers
230
views
I am new KDFs. I need backgrounds of KDF and ASN x9.63, HKDF using Java
JavaCard 3.1 introduces this KDF as part of this release. Can someone help me in understanding this topic clearly? (KDF ANS X9.63). I need some parameters informations. What is shared secret and ...
2
votes
1
answer
3k
views
Why is SHA384 used in TLS cipher suites for AES_256_GCM instead of SHA256?
TLS cipher suites use SHA256 as the hash when using AES_128_GCM and CHACHA20_POLY1305, but SHA384 when using AES_256_GCM.
The TLS Cipher Suite Registry contains no cipher suites that use ...
- 4,790
6
votes
1
answer
1k
views
HKDF randomness extraction - salt or no salt?
According to the HKDF paper, the use of a salt serves two purposes: domain separation and randomness extraction.
This question is solely about the necessity of a salt for the purposes of randomness ...
- 4,790
4
votes
1
answer
1k
views
Applications in which you should/shouldn't use a salt with HKDF
rfc5869 has the following to say about the use or lack thereof of salts with HKDF:
HKDF is defined to operate with and without random salt. This is done to accommodate applications where a salt value ...
2
votes
0
answers
75
views
key reuse: does knowing H(S) reveal HMAC(S)
given a hash H() , like sha256
and a secret text S
and a public salt P
will knowing H(S) reveal HMAC(P, S) ?
to clarify: the question is if it possible to learn the digest, not the secret.
In my ...
- 121
1
vote
0
answers
203
views
Combining Post-Quantum and Classical KEM
I came across this paper "Hybrid Key Encapsulation Mechanisms", were three methods are defined that allow a secure combination of a classical key encapsulation with a post-quantum key ...
- 317
1
vote
1
answer
220
views
HKDF with predefined IV
Can I generate from a randomly generated key let say three other keys via HKDF with predefined IVs, eg. Sha-256 of "apple", "banana", "pear"?
My use-case is an app that ...
3
votes
2
answers
587
views
How many different keys can be derived with HKDF before two outputs are identical?
How many different keys can be derived with HKDF before two outputs are identical?
This question is about collision resistance, not about generating different keys with different parameters (eg. ...
- 31
0
votes
0
answers
31
views
Randomizing output of HKDF for the same input key material [duplicate]
Given HKDF and a master input material key $k$, I would like to derive ephemeral keys that cannot be linked together. If I understand correctly, the specification of $HKDF$ adding a unique random $...
- 235
2
votes
0
answers
163
views
Encryption: filename + timestamp as info for HKDF-Expand
Let's assume that a user wants to symmetrically encrypt the files in one of his folders (being able to decrypt them later).
For this, I have come up with the following procedure:
A random 32 byte ...
- 21
0
votes
1
answer
84
views
Use of the info parameter in Hybrid Public Key Encryption
I dont understand the use of the info parameter, what does "to fold in identity information" mean? What is the security benefit?
All the algorithms also take an info parameter that can be ...
- 151
1
vote
2
answers
377
views
Static salt for PBKDF2, but unique salt for HKDF?
Hypothetical. Lets say you have an application where you generate a master key from a user password using PBKDF2 (static salt) and then use the master key to derive two passwords keys for an encrypt-...
- 197
3
votes
1
answer
131
views
Is HKDF one-way, namely given `Ko` it's hard to guess `Ki`?
For background, a HKDF (hmac based key derivation function) takes the form of Ko = KDF(Ki, Label, Context, Len) where Ki is the ...
- 326
4
votes
1
answer
454
views
Is PBKDF2 with 1 iteration acceptable for a simple random key expansion?
I have a 128 bit randomly generated key. I need to expand this key to 512 bits to use with an existing encryption library that does AES-256 encryption in CBC mode with HMAC-SHA256 authentication.
The ...
- 611
2
votes
1
answer
391
views
Apply HKDF after Diffie-Hellman Key Exchange
I'm trying to use HKDF after Diffie-Hellman key exchange. However, I got stuck on the HKDF part.
...
- 21
0
votes
1
answer
191
views
Using the output of HKDF directly
I am using HKDF with an IKM and salt, the OKM is used as the key for an HMAC operation. The HMAC algorithm is authenticating messages in a communications system
The salt is the concatenation of 2 ...
- 3
1
vote
3
answers
217
views
Calculate the complexity of HKDF with a 96bit salt and a 128bit key?
I have a 128 bit Pre-Shared Key. I don't want to use it directly. I'd much rather generated a session key with HKDF(PSK, SALT) = SESSIONKEY.
I'm however under ...
7
votes
1
answer
4k
views
Multiple AES Key Derivation from a master key
I need cryptography advice regarding this issue.
Kamus is a service that encrypts secrets for applications running on Kubernetes. When using AES (actually, Rijndael) symmetric encryption, Kamus uses ...
1
vote
1
answer
443
views
Recommended Shake256 digest size for KMAC based HKDF
On the wiki page for HKDF, in the Python Implementation, there is a hash_length variable for the ...
- 623