Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
0
votes
1answer
34 views

Key Derivation/Hashing Function with Fast Comparison

Is there a key derivation/hashing function (that has any real value) that fulfills both of these criteria: Slow to compute the hash Fast to verify the hash based on the input string (not given a ...
1
vote
0answers
44 views

How to compose (H)KDF, Encryption and (H)MAC

For legacy reasons one of my systems doesn't have the option of using an AEAD mode, we are restricted to AES in plain CBC or CTR mode plus a MAC. A typical task is to transfer data from one node to ...
2
votes
2answers
133 views

What's bad about idea of public-key/one-time-pad hybrid cryptosystem?

As i know, generally nowadays hybrid protocols are more widely used than either symmetric or public key cryptosystems separately. I read that public key system is used to exchange and share secret via ...
2
votes
1answer
55 views

Questions: Argon2, its internal state and security of it when generating keys larger than 256/512 bits

Let's suppose I want to use a cipher with a large key size, such as ISAAC that supports 8192 bits ogf key. I can hash with sha-256 or sha-512 and iterate until reaches the key size but I won't get ...
1
vote
0answers
62 views

How secure is it to use a 128-bit random seed to derive a 256-bit key for seeding key-pair generation?

We are developing an open-source peer-to-peer app, Mapeo, designed for users with low technical experience (and no email or phone) to collect data in offline environments. We are generating their ...
3
votes
2answers
197 views

Are PRNGs Key Derivation Functions?

PRNG is a mechanism to produce randomness from an initial random seed, so basically a way to derive more secrets from one secret. Looking at the Wikipedia entry for KDF you find In cryptography, a ...
2
votes
2answers
135 views

How is Argon2 used for key derivation? [duplicate]

By my understanding, a key derivation is when you take some data, say a password, and use a function to convert it into a number that can be used as a secret key in say elliptic curve cryptography. ...
4
votes
1answer
114 views

How to securely derive a key from a list of sorted random bytes?

Is it possible to derive a secure cryptographic key from an array of sorted bytes, assuming the bytes themselves were generated in a secure manner (say, from quantum phenomenon)? What would be the ...
3
votes
2answers
423 views

Difference between Non-uniformly random and Uniformly random

I am reading up on Key Deriving Functions (KDF) and in a section of the Real-World Cryptographic book by David Wong, a comparison is being made with Pseudorandom number generator (PRNG). And one of ...
1
vote
0answers
56 views

Memory-hard key derivation algorithm where all requested memory is needed at every time moment

Background. All MKDF (memory-hard KDF) algorithms that I know (Scrypt, Argon2, Balloon) don't really require all the memory at every moment during the run time of algorithm's implementation, but ...
1
vote
1answer
51 views

Generate unique random values for unqiue input values

I'm going to generate unique random values based per a range of unique input values. In other words I have range of input values which these numbers are part of a series (like a range of serial ...
-2
votes
1answer
33 views

Problem understanding the difference between passphrase and keyfiles

Ok, so I have read a few different articles on subject and am maybe just just having problems understanding the point of view from the program I am using or maybe not IDK. Anyhow, ill get into it. ...
1
vote
1answer
121 views

Estimation of the entropy of keys derived from truly random numbers

NOTE: This question is based on my assumption that $X$ is a "truly random number" if and only if it's length measured in bits is equal to its entropy measured in bits. In other words, when ...
1
vote
3answers
82 views

Derivating random numbers from random numbers

If I have a "truly random number" $K$ of $L$ bits (whatever "truly random" means... is it a value from a normal distribution a truly random number, or only uniform distributions ...
1
vote
1answer
36 views

Rivest Cipher 6 (RC6) Key Scheduler

I am trying to understand the Key Scheduler used in RC6 and I have a total of 3 questions. The RC6 Wikipedia page says that the only difference between the RC5 and RC6 key scheduler is that more words ...
3
votes
2answers
104 views

Don't human generated passwords used with key derivation functions reduce the security of symmetric encryption?

The key size for AES is chosen as 256 because that's considered the minimum keysize which can protect against a brute force attack - i.e. $2^{256}$ tries. However, in practice, for a lot of ...
0
votes
0answers
27 views

User key management scheme: BYOK vs. client only keys vs. a mix of both

We are designing a web app where users can share documents with each other. The ultimate goal is to achieve zero trust needed by the users, i.e. client-side encryption makes sure that the servers (or ...
7
votes
2answers
1k views

Do I need to sanitize user input to scrypt, or to PBKDF's in general?

I'd like to allow the user to supply a password as input to some PBKDF, which I will use to construct a key for file encryption (currently using aes-256-ctr. It may change as I learn more). I am ...
1
vote
0answers
41 views

Combining Post-Quantum and Classical KEM

I came across this paper "Hybrid Key Encapsulation Mechanisms", were three methods are defined that allow a secure combination of a classical key encapsulation with a post-quantum key ...
0
votes
0answers
48 views

Saving highly sensitive data in US cloud - what encryption would you use?

We have a cloud-based application running on AWS servers and are looking for a way to store highly sensitive user data there without giving AWS the possibility of exposing our data to the US ...
2
votes
3answers
456 views

Efficient way to pick an array index by using a, say, 64 bit random number?

Say, I have uint64_t rand = <some random number>, and char array[20] = .... My goal is to pick an element in ...
1
vote
1answer
49 views

HKDF with predefined IV

Can I generate from a randomly generated key let say three other keys via HKDF with predefined IVs, eg. Sha-256 of "apple", "banana", "pear"? My use-case is an app that ...
0
votes
0answers
41 views

Managing master keys used in PBKDF2 and HMAC (store, rotate)

My use case: I have few master keys, I use each for a specific operation (e.g. one for encrypting user's data and another for creating JWT signatures etc...). I use these master keys in two specific ...
2
votes
2answers
90 views

AWS signature v4 key derivation

Generating Authorization header with AWS signature v4 involves deriving signing key as follows: https://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html ...
1
vote
0answers
20 views

Can the hash of a PKCS1 v1.5 RSA signature be used as a key derivation function?

I know this sounds crazy, but hear me out. As a follow-up to Can the AES-GCM authentication tag be used as a key derivation function?, I'm also considering more creative solutions to derive unique (...
2
votes
1answer
78 views

Can the AES-GCM authentication tag be used as a key derivation function?

I want to build a deterministic key derivation tree, where the root is stored securely in a centralized service and the leaves are embedded in a multitude of devices. When a device wants to ...
1
vote
1answer
226 views

CTR overlap with random IV

Problem: I'm slightly worried about counter repeats in CTR mode when using random IV. If you split it (like half IV, half counter), it increases chances of same IV (it is smaller) and limits message ...
-2
votes
1answer
37 views

Encrypted file sharing with deterministically generated key from user password

Background info: I need to encrypt files in a enterprise workspace with several users. The goal is to encrypt files directly from browser to be saved on a server and each user could decrypt files for ...
3
votes
1answer
82 views

Is PRF XORed with its key still a PRF? (always)

$\forall k \in \{0,1\}^n,m \in \mathbb{M},F_k(m)$ is defined as follows: $F_k(m) = F'_k(m) \oplus k$. It is known that $F'_k$ is a PRF. Note: 𝕄 is the message space and it's assumed that the key $k$ ...
1
vote
2answers
64 views

is it safe to combine scrypt with other hash algorithms?

I'm currently writing a file encryption program, and I designed this scheme to derive a key from user input password: ...
0
votes
0answers
39 views

Why do you need to apply hash over DH shared key? [duplicate]

I`ve read multiple times that it is not safe to use the shared key resulted from DH key exchange directly and that you need to do a KDF or hash over it and then use the result as a key. Why is it not ...
0
votes
0answers
78 views

Adding salt to Blake3 Key derive function

According to the whitepaper, Blake3 can be used as a key derivation function (function key_derive). Currently, as a key ...
1
vote
1answer
85 views

Am I using these key derivation functions correctly?

I am a bit confused about key derivation functions. I am trying to use the argon2 KDF from the passlib python module to do the ...
0
votes
1answer
206 views

AES Password Based Key Derivation Iterations

I have been writing my own implementation of the Advanced Encryption Standard with cipher block chaining in python3 for the last several months, mimicking the OpenSSL command line interface. I can ...
3
votes
2answers
158 views

How many different keys can be derived with HKDF before two outputs are identical?

How many different keys can be derived with HKDF before two outputs are identical? This question is about collision resistance, not about generating different keys with different parameters (eg. ...
0
votes
0answers
26 views

Randomizing output of HKDF for the same input key material [duplicate]

Given HKDF and a master input material key $k$, I would like to derive ephemeral keys that cannot be linked together. If I understand correctly, the specification of $HKDF$ adding a unique random $...
2
votes
1answer
345 views

Is tagging the hash of a password along with ciphertext secure?

Suppose I have a password, in which I use Argon2ID with 1GB memory to derive an encryption key. Then, I encrypt my data using XChaCha20 using that encryption key. The problem with ChaCha is that any ...
0
votes
0answers
41 views

How does order in KDF formula affect its security proof?

If the expansion phase of key derivation is captured by the abstract formula (per Krawczyk): KM = PRF* (PRK, CTX, L) Then what happens to the security proofs if someone were to swap PRK and CTX. For ...
0
votes
0answers
52 views

Best way to derive a MAC key without a salt

It's best to use separate keys for encryption and the MAC. Most implementations tend to derive a larger key and split it in two (e.g. scrypt with an output of 32 + 64 = 96). Alternatively, you can ...
0
votes
0answers
77 views

Deterministic generation of secure private keys from parent private key

is it possible to generate set of child private keys from one parent private key, generated by ECC for example, securely? So that new private key (and derive public key) could be used for encryption ...
0
votes
1answer
144 views

Deterministic Key using a seed for ECNamedCurve

I am trying to generate deterministic keys using EC curve secp521r1 in java. I went through KDF but, couldn't find any references to use it with EC curves. I would appreciate if someone could point me ...
1
vote
1answer
210 views

Best practise for encryption in a password manager

I'm trying to make a password manager for Windows installed computers, and after researching the best ways to encrypt the passwords in the database (I'm new to cryptography) I think I've come up with ...
0
votes
1answer
36 views

Use of the info parameter in Hybrid Public Key Encryption

I dont understand the use of the info parameter, what does "to fold in identity information" mean? What is the security benefit? All the algorithms also take an info parameter that can be ...
1
vote
2answers
124 views

Static salt for PBKDF2, but unique salt for HKDF?

Hypothetical. Lets say you have an application where you generate a master key from a user password using PBKDF2 (static salt) and then use the master key to derive two passwords keys for an encrypt-...
2
votes
1answer
161 views

How to encrypt many files with AES-GCM, without running the key derivation function each time?

Linked question: AES encrypting multiple files With a password, I have 100k files to encrypt. (Maybe 100k files today; or maybe 50k today, 10k tomorrow, and 40k ...
1
vote
1answer
877 views

Zerologon question - AES-CFB8

I was reading the zerologon whitepaper by secura named: Unauthenticated domain controller compromise by subverting Netlogon cryptography. I'm trying to understand the zerologon attack. The issue is ...
0
votes
0answers
34 views

What's the tightest time-space trade-off law for unbounded time and space?

Let's say that my CPU can be made arbitrarily faster (or I can become arbitrarily patient waiting for the CPU to complete its task), and let's say that my memory (e.g. RAM) can be made arbitrarily ...
3
votes
1answer
149 views

Is PBKDF2 with 1 iteration acceptable for a simple random key expansion?

I have a 128 bit randomly generated key. I need to expand this key to 512 bits to use with an existing encryption library that does AES-256 encryption in CBC mode with HMAC-SHA256 authentication. The ...
2
votes
1answer
198 views

How to estimate the maximum computational cost bound for Key Derivation Functions (KDFs) before it becomes useless security-wise?

From my understanding of Key Derivation Functions (KDFs), e.g. scrypt, Argon2, etc, we can tune their parameters such that it eventually becomes harder for an attacker to brute force a password-to-key ...
1
vote
1answer
160 views

Using a nonce as a salt for key derivation

I'm currently playing a bit with PyNaCl (python binding to libsodium) and I want to use the secretbox for symmetric encryption between two parties, which means they both must know the (in my case ...

1
2 3 4 5
11