Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
3 votes
2 answers
49 views

RSA perfect square phi

So I've been learning about RSA for quite a while (mainly by playing around in CTF competitions) and I came across an interesting problem. The other day I was looking to create a challenge in which I ...
Anonymous's user avatar
1 vote
2 answers
118 views

What scheme is the best for combining two shared secrets?

I'm developing a program that uses a hybrid Key Encapsulation Mechanism (KEM) scheme, employing Kyber and X25519, with each producing a 32-byte shared secret. What would be the best scheme to combine ...
Zola Gonano's user avatar
0 votes
0 answers
70 views

Is it safe to derive a secret from a signature?

Many blockchain users have wallets that hold a private key, which can interact with a website. For example, the website can request the wallet to sign a specific message. 'Do only sign this message if ...
user599464's user avatar
0 votes
1 answer
48 views

Is there an open source key-derivation service?

Hello sorry if this is a silly question and do say if this would be more suitable for a software stack-exchange but after a lot of googling I've still not found anything suitable, so starting to worry ...
Alex Dawn's user avatar
0 votes
0 answers
44 views

Entropy output from 256-bit Argon2 input [duplicate]

I would like to deterministically derive two different 256-bit keys from a single passphrase -- one used as an ECDSA private key, the other as a symmetric key for AES-GCM. Would a KDF output ...
Astrochamp's user avatar
1 vote
1 answer
176 views

Key exchange for encrypted firmware update

I'm trying to implement encrypted firmware update functionality for an embedded device. The goal is to prevent reverse engineering of our firmware when the update files are shared with our customers. ...
MDude's user avatar
  • 23
4 votes
1 answer
91 views

Robust CMAC-based key derivation function

I need to select a key derivation function that will likely be used in contexts that I haven't anticipated. It will run on very low-end devices (think potato-powered IoT sensor with a bulk cost of a ...
Gilles 'SO- stop being evil''s user avatar
2 votes
0 answers
63 views

Why KeePassXC is deriving (stretching) the key again before saving changes to the database?

KeePassXC supports Argon2, which is great for security. However, there's a quirk that's been bothering me. Every time I save modifications to the database, it seems to stretch (derive) the key again, ...
Valentin Stoykov's user avatar
1 vote
0 answers
24 views

Scheme to derive an encryption key from one's verification key, so they can reduce the decryption key from it and their signing key? [duplicate]

There is DH key exchange, but it requires an exchange before participants get to the shared secret. If Bob has only published a verifying key VB, is there a scheme where the following can be achieved? ...
Blair Noctis's user avatar
1 vote
0 answers
72 views

Two-party randomness for KEM

As indicated in an earlier Q / A, KEM's do not necessarily directly encrypt a pre-generated random value. However, it is clear that some KEM's do actually do this, with RSA-KEM being an obvious ...
Maarten Bodewes's user avatar
  • 91.9k
1 vote
2 answers
179 views

Why does ECIES use "Key Encapsulation"? Does it?

In yet another twist that is the terminology around key establishment I found out that ECIES is often denoted as key encapsulation followed by data encapsulation. I'm wondering how the term "key ...
Maarten Bodewes's user avatar
  • 91.9k
0 votes
0 answers
85 views

Question regarding JWK generation using RSA-PSS 4096

Summarized Question: In the context of JWK generation using RSA-PSS 4096bit with SHA-256, where the public exponent is "e" = 65537, is there any situation ...
nomad.lw's user avatar
0 votes
1 answer
87 views

How much of SHA3's internal state can be reached?

After reading that about "37% of the 256-bit outputs" of SHA-256 are unreachable when fed only 256-bit inputs [1] I'm curious & confused. The formula from the proof here considers a ...
aiootp's user avatar
  • 785
0 votes
1 answer
63 views

RFC: Approach to CSPRNG

I've been experimenting in python with different approaches to cryptographically secure pseudo random number generators, comparing them using the NIST testsuite implemented by https://github.com/...
Amo's user avatar
  • 1
0 votes
1 answer
89 views

Is keccak256 (and similar hash functions) a suitable KBKDF for 256-bit keys?

Let's temporarily work upon the assumption that proper KBKDF functions do not exist, for the sake of argument. Would keccak256 be a secure choice for a KBKDF that derives 256-bit keys from a 256-bit ...
rrrrrrrrrrrrrrrr's user avatar
1 vote
0 answers
55 views

Linux Kernel CryptoAPI key exchange and key derivation

I have a custom network and I want to implement a symmetric key exchange and key derivation mechanism with ECDH. I know that I need to use KPP API and ECDH helper functions, but I can't find any code ...
Ham's user avatar
  • 11
0 votes
0 answers
36 views

DES encryption Key from a passphrase

I have been given a DES encryption assignment. I was given the Cipher text, the Plain text and the "passphrase". The passphrase consist of a 4 byte hex string. I have studied several ...
RikiD's user avatar
  • 1
0 votes
0 answers
101 views

PCI compliance - use of ANSI X9.17 for export keys

we have a concern about a key export. We completed the migration to Key Block LMK in our environment (with HSM Thales 10K). Now, we have to exchange keys with third-parties that still use Keys in ...
MaXbeMan's user avatar
5 votes
2 answers
187 views

Cache-hard or memory-hard password hashing algorithms?

bscrypt is a cache-hard password hashing algorithm/KDF from Steve Thomas (aka Sc00bz/TobTu), who was on the Password Hashing Competition (PHC) panel. He argues it is better than the alternative ...
samuel-lucas6's user avatar
0 votes
1 answer
118 views

Clarification on the use of Key block Version ID with Thales HSM

Clarification on the use of Key block Version ID For the first time since we migrated to the Key Block we are exchanging keys with third parties, The keys were all generated by choosing Key Scheme &...
MaXbeMan's user avatar
2 votes
0 answers
37 views

ZKP of knowledge of EC keys preimage

There is a random scalar seed $s$ which we may call a master secret. There are 2 public strings or scalars: $m1, m2$ and 2 corresponding EC keypairs: $a, A=a*G$ and $b, B=b*G$ $a$ and $b$ are somehow ...
John dow's user avatar
  • 149
2 votes
1 answer
135 views

Deterministic EC key derivation with anonymity and proofs

Following up this question There are 4 parties: Alice, who needs to prove a posession of some statement $m$, unique to her, say a street address, which is basically a string of some predefined format,...
John dow's user avatar
  • 149
3 votes
1 answer
52 views

It is correct to concatenate HKDF expand stages?

I want to derive session keys for many clients from a Master Key. Suppose I derive a key for the client $n$ in the following way: master_key = HKDF-extract(salt, IKM) key_client_n = HKDF-expand(...
Different-March-5530's user avatar
1 vote
1 answer
88 views

Manually deriving asymmetric key pairs with Openssl

In Openssl, is there a way to systematically generate a private key such that every time you perform this key derivation, you produce the same private key? It seems like every openssl command that ...
Nicholas Cousar's user avatar
3 votes
1 answer
324 views

Is the output of HKDF uniformly distributed, if my input is not?

I have done some research on HKDF but I am still not sure about the security properties in different scenarios. Which properties are fullfilled, when IKM and the salt are random and secret, but not ...
p_1092131280's user avatar
1 vote
1 answer
879 views

How do non-"resident" keys work in WebAuthn?

If we look at the WebAuthn specification, then, during the "registration" ceremony, the authenticator generates a new key-pair and a unique user-id. Then the public-key and the unique user-...
Uwe Kohl's user avatar
4 votes
0 answers
40 views

What is the impact of leaving a salt used in HKDF open to attacker control? [duplicate]

RFC 5869 for HKDF says "an application needs to make sure that salt values are not chosen or manipulated by an attacker".1 Soatok also discusses some nuances in choosing salts for HKDF.2 ...
notatypewriter's user avatar
2 votes
1 answer
319 views

Deriving secret keys vs generating and encrypting them

Suppose one has a password manager, based on symmetric cryptography, that requires a master passphrase to be unlocked. Argon2 is used for deriving a secret key from the master passphrase. I need ...
user2373145's user avatar
1 vote
1 answer
71 views

Can HKDF be used in place of a cryptographic hash function?

For context, I'm making a non-production grade reference implementation of the balloon hash function using the Web Crypto API. In order to make it less susceptible to certain attacks on common memory ...
n-l-i's user avatar
  • 435
0 votes
0 answers
377 views

Cracking 2-Key Triple DES

I've been given that an attacker has a 2-Key Triple DES Cracker that is capable of performing 10$^{24}$ encryptions per second and have subsequently been asked how long it must take before the ...
murpw2011's user avatar
  • 101
28 votes
4 answers
7k views

Is there a hash function that's more expensive for an attacker than for the server?

Say a server wants to hash a password $p$. It would use a secure hash function $H$ and a unique salt $s$ to hash the password as $H(p,s)$. If one has access to the salt, each password candidate ...
n-l-i's user avatar
  • 435
1 vote
1 answer
76 views

Understanding symmetric encryption security in relation to password-based key derivation

Here are some assumptions on which the question is based. If anything is wrong with this, please point this out straight away: Let's say I have a file I want to encrypt with AES256 symmetric ...
xsw2_2wsx's user avatar
2 votes
0 answers
53 views

Deriving multiple deterministic keys in a Schnorr Multisig setup

Let's say that Alice and Bob have generated truly random private keys $a$ and $b$ and want to use them in Schnorr signing. They calculate $X = g^a \cdot g^b$ as their mutual public key. For whatever ...
werki's user avatar
  • 21
5 votes
1 answer
347 views

For password-based authenticated encryption is it OK to derive the auth key from the crypt key with 1 iteration?

That is, in the case where the iterations value is a large number, since iterations are costly is there a difference in security of doing something like this, where two separate derivations are ...
wabo's user avatar
  • 153
2 votes
2 answers
294 views

Can you restore a private key from biometrics?

My understanding is that iOS FaceID/Fingerprint for example use an underlying mathematical representation of the biometric features. Is it possible to generate a key pair from this representation and ...
TommyF's user avatar
  • 123
0 votes
0 answers
269 views

Old openssl version does not support -iter or -pbkdf2, how does it derive the encryption key for AES?

When using openssl or libressl to encrypt or decrypt data with AES, I typically specify ...
RocketNuts's user avatar
  • 1,397
4 votes
2 answers
457 views

Deriving private keys from a signature/HSM

I have access to an HSM that can sign messages but doesn't have a way to expose the private key. The signatures are deterministic (RFC 6979). Another application only works with ed25519 signatures ...
telescope's user avatar
4 votes
2 answers
518 views

Does combining multiple PBKDF2 keys result higher iteration count when using same password but different salts?

I did some experimenting with web subtle crypto. I derived a key using PBKDF2 with SHA-512 and 100 000 iterations and timed it. Doing same with 200 000 rounds doubled the time as expected. Then I did ...
Puruporo's user avatar
3 votes
1 answer
957 views

Why does SHA-256 have any to do with scrypt?

I was reading the Wikipedia page for scrypt because I wanted to learn more about it and I came across their pseudocode for the algorithm. What confused me was the following line: I don't understand ...
Darcy Sutton's user avatar
0 votes
0 answers
51 views

Client Side Encryption For Web Apps

I want to build something where web clients encrypt some data server side and store it with me. However, I am not sure how to manage the user keys - ideally they can just sign in with social to access ...
CSAMS's user avatar
  • 1
1 vote
1 answer
88 views

Is there any point in extending an 80-bit key before using it for HMAC-SHA256?

I have been asked to make a HMAC-SHA256 password digest from: a password some salt, and an 80-bit secret key. I've been advised that I should be using a key of 256 bits or more for HMAC-256. The key ...
fadedbee's user avatar
  • 897
2 votes
1 answer
234 views

Benefit of salt in KDF like Argon2

I don't understand why I need a salt for Argon2 if Argon2 is only needed as a KDF for a password which is then called AES. At the end neither the password nor a password hash is stored. Only the data ...
user105538's user avatar
0 votes
2 answers
236 views

Argon2 derive two keys from one password

This is not a duplicate, I'm asking which method is better. I generate an encoded argon2 hash string, so it'll be stored in database to verify login passwords. Saved encoded hash has salt of length ...
koala's user avatar
  • 1
1 vote
2 answers
168 views

How are RSA and Elliptic Curve keys generated deterministically?

Going through the TPM tutorial: https://google.github.io/tpm-js/#pg_keys The output of KDF would be some pseudo-random bytes. For RSA, the bytes might not be a prime number. For elliptic curves, the ...
krkhan's user avatar
  • 87
0 votes
2 answers
82 views

What is the standard checklist for designing a Key Derivation Function?

What kinds of properties does a KDF need to have in order to be considered secure? What steps should be taken during analysis to test for flaws? In particular, I mean a KDF that is going to be used as ...
Wesley Jones's user avatar
1 vote
2 answers
122 views

How is $Nb$ (number of columns) calculated in AES (Rijndael)?

The NIST publication for AES defines $Nb$ as: Number of columns (32-bit words) comprising the State. For this standard, Nb = 4. In Section 5.2: Key Expansion, $Nb$ has been used to calculate the ...
Amal K's user avatar
  • 111
3 votes
2 answers
402 views

Is a simple KMAC-128 or KMAC-256 hash secure as a KDF?

Context I am trying to build a simple protocol for key derivation. I want to use SHA-3 family hash functions, which (as far as I understand) should not be combined with HMAC because their security ...
Ben Zelnick's user avatar
2 votes
1 answer
475 views

(How) can Argon2 be used to create both a hash for authentication and a secret key?

The Argon2 specs claim that Argon2 can be used both for password hashing and key derivation. I want to generate from a single password both a hash for authentication and a secret key to use for ...
BGWPVqRM3xIg's user avatar
2 votes
2 answers
111 views

How do KDFs work, and what existing implementations exist?

TLDR/End goal I want to encrypt a tree of data/files so that anyone with the master key K can decrypt everything, key K-1 can ...
Kaiden Prince's user avatar
5 votes
1 answer
374 views

Apple "Find My" Key Rotation

Apple's Find My technology is described in this Wired article and explains how Apple, or other third parties, are not able to decrypt location data. It mentions how the keys are rotated every hour: ...
Jared's user avatar
  • 153

1
2 3 4 5
13