Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
3
votes
1answer
99 views

How to securely derive a key from a list of sorted random bytes?

Is it possible to derive a secure cryptographic key from an array of sorted bytes, assuming the bytes themselves were generated in a secure manner (say, from quantum phenomenon)? What would be the ...
3
votes
2answers
402 views

Difference between Non-uniformly random and Uniformly random

I am reading up on Key Deriving Functions (KDF) and in a section of the Real-World Cryptographic book by David Wong, a comparison is being made with Pseudorandom number generator (PRNG). And one of ...
1
vote
0answers
53 views

Memory-hard key derivation algorithm where all requested memory is needed at every time moment

Background. All MKDF (memory-hard KDF) algorithms that I know (Scrypt, Argon2, Balloon) don't really require all the memory at every moment during the run time of algorithm's implementation, but ...
1
vote
1answer
48 views

Generate unique random values for unqiue input values

I'm going to generate unique random values based per a range of unique input values. In other words I have range of input values which these numbers are part of a series (like a range of serial ...
2
votes
0answers
56 views

Is it possible to use HKDF in the TPM? [migrated]

Is it possible to use HKDF in the TPM? My goal is to load in a master symmetric key and derive keys from that using HKDF. I see there are other KDF functions available, but no mention of HKDF.
-2
votes
1answer
22 views

Problem understanding the difference between passphrase and keyfiles

Ok, so I have read a few different articles on subject and am maybe just just having problems understanding the point of view from the program I am using or maybe not IDK. Anyhow, ill get into it. ...
1
vote
1answer
116 views

Estimation of the entropy of keys derived from truly random numbers

NOTE: This question is based on my assumption that $X$ is a "truly random number" if and only if it's length measured in bits is equal to its entropy measured in bits. In other words, when ...
1
vote
3answers
79 views

Derivating random numbers from random numbers

If I have a "truly random number" $K$ of $L$ bits (whatever "truly random" means... is it a value from a normal distribution a truly random number, or only uniform distributions ...
1
vote
1answer
32 views

Rivest Cipher 6 (RC6) Key Scheduler

I am trying to understand the Key Scheduler used in RC6 and I have a total of 3 questions. The RC6 Wikipedia page says that the only difference between the RC5 and RC6 key scheduler is that more words ...
3
votes
2answers
101 views

Don't human generated passwords used with key derivation functions reduce the security of symmetric encryption?

The key size for AES is chosen as 256 because that's considered the minimum keysize which can protect against a brute force attack - i.e. $2^{256}$ tries. However, in practice, for a lot of ...
0
votes
0answers
24 views

User key management scheme: BYOK vs. client only keys vs. a mix of both

We are designing a web app where users can share documents with each other. The ultimate goal is to achieve zero trust needed by the users, i.e. client-side encryption makes sure that the servers (or ...
7
votes
2answers
1k views

Do I need to sanitize user input to scrypt, or to PBKDF's in general?

I'd like to allow the user to supply a password as input to some PBKDF, which I will use to construct a key for file encryption (currently using aes-256-ctr. It may change as I learn more). I am ...
1
vote
0answers
38 views

Combining Post-Quantum and Classical KEM

I came across this paper "Hybrid Key Encapsulation Mechanisms", were three methods are defined that allow a secure combination of a classical key encapsulation with a post-quantum key ...
0
votes
0answers
47 views

Saving highly sensitive data in US cloud - what encryption would you use?

We have a cloud-based application running on AWS servers and are looking for a way to store highly sensitive user data there without giving AWS the possibility of exposing our data to the US ...
2
votes
3answers
446 views

Efficient way to pick an array index by using a, say, 64 bit random number?

Say, I have uint64_t rand = <some random number>, and char array[20] = .... My goal is to pick an element in ...
1
vote
1answer
47 views

HKDF with predefined IV

Can I generate from a randomly generated key let say three other keys via HKDF with predefined IVs, eg. Sha-256 of "apple", "banana", "pear"? My use-case is an app that ...
0
votes
0answers
37 views

Managing master keys used in PBKDF2 and HMAC (store, rotate)

My use case: I have few master keys, I use each for a specific operation (e.g. one for encrypting user's data and another for creating JWT signatures etc...). I use these master keys in two specific ...
0
votes
1answer
58 views

AWS signature v4 key derivation

Generating Authorization header with AWS signature v4 involves deriving signing key as follows: https://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html ...
1
vote
0answers
18 views

Can the hash of a PKCS1 v1.5 RSA signature be used as a key derivation function?

I know this sounds crazy, but hear me out. As a follow-up to Can the AES-GCM authentication tag be used as a key derivation function?, I'm also considering more creative solutions to derive unique (...
2
votes
1answer
49 views

Can the AES-GCM authentication tag be used as a key derivation function?

I want to build a deterministic key derivation tree, where the root is stored securely in a centralized service and the leaves are embedded in a multitude of devices. When a device wants to ...
1
vote
1answer
191 views

CTR overlap with random IV

Problem: I'm slightly worried about counter repeats in CTR mode when using random IV. If you split it (like half IV, half counter), it increases chances of same IV (it is smaller) and limits message ...
-2
votes
1answer
37 views

Encrypted file sharing with deterministically generated key from user password

Background info: I need to encrypt files in a enterprise workspace with several users. The goal is to encrypt files directly from browser to be saved on a server and each user could decrypt files for ...
3
votes
1answer
73 views

Is PRF XORed with its key still a PRF? (always)

$\forall k \in \{0,1\}^n,m \in \mathbb{M},F_k(m)$ is defined as follows: $F_k(m) = F'_k(m) \oplus k$. It is known that $F'_k$ is a PRF. Note: 𝕄 is the message space and it's assumed that the key $k$ ...
1
vote
2answers
61 views

is it safe to combine scrypt with other hash algorithms?

I'm currently writing a file encryption program, and I designed this scheme to derive a key from user input password: ...
0
votes
0answers
39 views

Why do you need to apply hash over DH shared key? [duplicate]

I`ve read multiple times that it is not safe to use the shared key resulted from DH key exchange directly and that you need to do a KDF or hash over it and then use the result as a key. Why is it not ...
0
votes
0answers
58 views

Adding salt to Blake3 Key derive function

According to the whitepaper, Blake3 can be used as a key derivation function (function key_derive). Currently, as a key ...
1
vote
1answer
75 views

Am I using these key derivation functions correctly?

I am a bit confused about key derivation functions. I am trying to use the argon2 KDF from the passlib python module to do the ...
0
votes
1answer
175 views

AES Password Based Key Derivation Iterations

I have been writing my own implementation of the Advanced Encryption Standard with cipher block chaining in python3 for the last several months, mimicking the OpenSSL command line interface. I can ...
3
votes
2answers
145 views

How many different keys can be derived with HKDF before two outputs are identical?

How many different keys can be derived with HKDF before two outputs are identical? This question is about collision resistance, not about generating different keys with different parameters (eg. ...
0
votes
0answers
26 views

Randomizing output of HKDF for the same input key material [duplicate]

Given HKDF and a master input material key $k$, I would like to derive ephemeral keys that cannot be linked together. If I understand correctly, the specification of $HKDF$ adding a unique random $...
2
votes
1answer
334 views

Is tagging the hash of a password along with ciphertext secure?

Suppose I have a password, in which I use Argon2ID with 1GB memory to derive an encryption key. Then, I encrypt my data using XChaCha20 using that encryption key. The problem with ChaCha is that any ...
0
votes
0answers
38 views

How does order in KDF formula affect its security proof?

If the expansion phase of key derivation is captured by the abstract formula (per Krawczyk): KM = PRF* (PRK, CTX, L) Then what happens to the security proofs if someone were to swap PRK and CTX. For ...
0
votes
0answers
45 views

Best way to derive a MAC key without a salt

It's best to use separate keys for encryption and the MAC. Most implementations tend to derive a larger key and split it in two (e.g. scrypt with an output of 32 + 64 = 96). Alternatively, you can ...
0
votes
0answers
61 views

Deterministic generation of secure private keys from parent private key

is it possible to generate set of child private keys from one parent private key, generated by ECC for example, securely? So that new private key (and derive public key) could be used for encryption ...
0
votes
1answer
101 views

Deterministic Key using a seed for ECNamedCurve

I am trying to generate deterministic keys using EC curve secp521r1 in java. I went through KDF but, couldn't find any references to use it with EC curves. I would appreciate if someone could point me ...
1
vote
1answer
199 views

Best practise for encryption in a password manager

I'm trying to make a password manager for Windows installed computers, and after researching the best ways to encrypt the passwords in the database (I'm new to cryptography) I think I've come up with ...
0
votes
1answer
36 views

Use of the info parameter in Hybrid Public Key Encryption

I dont understand the use of the info parameter, what does "to fold in identity information" mean? What is the security benefit? All the algorithms also take an info parameter that can be ...
1
vote
2answers
102 views

Static salt for PBKDF2, but unique salt for HKDF?

Hypothetical. Lets say you have an application where you generate a master key from a user password using PBKDF2 (static salt) and then use the master key to derive two passwords keys for an encrypt-...
2
votes
1answer
127 views

How to encrypt many files with AES-GCM, without running the key derivation function each time?

Linked question: AES encrypting multiple files With a password, I have 100k files to encrypt. (Maybe 100k files today; or maybe 50k today, 10k tomorrow, and 40k ...
1
vote
1answer
718 views

Zerologon question - AES-CFB8

I was reading the zerologon whitepaper by secura named: Unauthenticated domain controller compromise by subverting Netlogon cryptography. I'm trying to understand the zerologon attack. The issue is ...
0
votes
0answers
33 views

What's the tightest time-space trade-off law for unbounded time and space?

Let's say that my CPU can be made arbitrarily faster (or I can become arbitrarily patient waiting for the CPU to complete its task), and let's say that my memory (e.g. RAM) can be made arbitrarily ...
3
votes
1answer
125 views

Is PBKDF2 with 1 iteration acceptable for a simple random key expansion?

I have a 128 bit randomly generated key. I need to expand this key to 512 bits to use with an existing encryption library that does AES-256 encryption in CBC mode with HMAC-SHA256 authentication. The ...
2
votes
1answer
179 views

How to estimate the maximum computational cost bound for Key Derivation Functions (KDFs) before it becomes useless security-wise?

From my understanding of Key Derivation Functions (KDFs), e.g. scrypt, Argon2, etc, we can tune their parameters such that it eventually becomes harder for an attacker to brute force a password-to-key ...
1
vote
1answer
140 views

Using a nonce as a salt for key derivation

I'm currently playing a bit with PyNaCl (python binding to libsodium) and I want to use the secretbox for symmetric encryption between two parties, which means they both must know the (in my case ...
2
votes
1answer
69 views

Why shouldn't cryptocurrency hash algorythms, resist side channel attack?

2015's Argon2 publication suggests that cryptocurrency hashing like password hashing on backend servers should not be subject to side-channel attack: Argon2d is optimized for settings where the ...
4
votes
1answer
642 views

How does the Concat KDF work?

I am writing an application using JSON Web Encryption with ECDH using the X25519 Curve. The RFC says that ECHD-ES derived secret is run through a Concat KDF. Given ...
3
votes
2answers
368 views

If P256 ECDH shared secret contains ~128 bits of security, does using first half of the secret (= 128 bits) contain only 64 bits of security?

There's this rather popular open source project (I'd rather not name it before possible responsible disclosure) that computes a P256 ECDH shared secret (256 bits) and uses only first half of it, rams ...
1
vote
1answer
584 views

How to choose parameters for Argon2 for a password vault

I'm creating a password vault, and I plan to use Argon2id to derive the master key from the master password. For encryption, I plan to use XChaCha20 with Poly1305. To be clear: a set of multiple ...
0
votes
1answer
61 views

Using platform-level RNGs for key derivation with hash functions like BLAKE3?

So I've read stack overflow questions like this one. What I'm wondering is a bit more specific though: I'm really liking what I'm seeing with BLAKE3. (I suspect that this hash function is relatively ...
0
votes
1answer
96 views

Why is SKEYSEED derived using the nonce as a key?

In IKEv2, SKEYSEED, which is used to as a seed for generating the rest of the keys, is generated as SKEYSEED = prf(Ni | Nr, g^ir)...

1
2 3 4 5
11