Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

4
votes
0answers
98 views

Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information of its advantages against CBC ...
0
votes
1answer
51 views

Does encrypting a result of AES block cipher provide more security?

I would like to know if encrypting a result of AES256 block cipher provides more security. Concretely, I am developing a system in which a client sends to a server a ciphertext encrypted with AES256. ...
3
votes
3answers
102 views

How to generate a good symmetric secret key

I would like to generate a good secret key, that later will be used to encrypt data symmetrically. I am not sure how to generate a good secret key. I use Linux, I am not sure which sources of ...
3
votes
1answer
68 views

Why derive keys from a master key instead of generating random keys?

I noticed AWS KMS generates encryption keys based off of a master key, using a key derivation function (HKDF). What's the practical advantage of deriving keys based on a master key? Isn't it simpler ...
2
votes
1answer
71 views

Using a KDF (PBKDF2) properly

I am new to crypto. I have a password for my user, e.g. &&38:while:HAVE:havana:60&& I want to encrypt several documents with 10 pages each with AES....
1
vote
2answers
38 views

How secure is a book derived key and what can be done to strenghten it? [duplicate]

If you have a manual encryption system where the keying is done by extracting a key from a book, a major weakness is that an adversary can search trough all existing books to find a perfect Match and ...
1
vote
0answers
50 views

Which 'info' and 'salt' parameters to use in HKDF for TLS 1.3?

all the following discussion is for HKDF in TLS1.3: Regarding the 'salt' parameter in - HKDF-Extract(salt, IKM) as written in RFC 5869: HKDF without having to protect the secrecy of the salt. In ...
1
vote
1answer
96 views

Is SHA-256 OK to use for key derivation for a key that is never persisted?

The scenario: On the one side a user enters a pass phrase to encrypt a stream of data (AES-GCM) and a symmetric encryption key is derived from the pass phrase using plain SHA-256 (so not a slow ...
2
votes
1answer
71 views

Generating a key pair using a signature generated by an existing key

I’ve built an app in which each user has a private/public key pair and I want to generate a second one for them, however I cannot store the second private key anywhere. What would be the drawbacks ...
1
vote
0answers
41 views

Reason for including the public key of the key agreement in the KDF

I found the following text when looking up KDFs: In comparison, the so-called DHAES mode in IEEE 1363a mandates to use the binary representation of the sender’s public key as an input parameter. ...
6
votes
3answers
212 views

Formal description of KDF1 and KDF2

I've seen many descriptions of KDF1 and KDF2 by now, but most documents simply point to specifications that are behind a pay wall. These standards are not specific to the KDF's; they just use these ...
1
vote
1answer
28 views

Restricting output of key derivation function

Are there any suitable key derivation functions that allow the output to have certain constraints applied to them?` I know you can choose a length in some functions (HKDF for example), but what about ...
2
votes
1answer
40 views

HKDF on output key material of previous HKDF

I understand the typical way to use HKDF is to make one call to HKDF to obtain multiple keys. Is it safe to use HKDF the following way to generate different keys ? If not, why? key0 = HKDF-extract-...
2
votes
1answer
52 views

What is meant by domain separation in the context of KDF?

This is a quote from my cryptography notes: If $h$ is a random function oracle of output length $n$ then also the two KDF constructions: $K(x) = h([0] \| x) \ldots \| h([L] \| x)$ $K(x) = ...
2
votes
1answer
320 views

Is it safe to split the output of PBKDF2?

I would like to know if splitting a key generated by PBKDF2 to derive two keys is a safe practice. Concretely, in my system, I need to derive two keys. One for symmetric cipher used in the client ...
4
votes
1answer
146 views

What is this EC key derivation method called?

I'm looking to identify the EC key derivation method used in Hyperledger Fabric. I can't find anything in the docs or the protocol specs, but the functions' code is here for the private key and the ...
2
votes
1answer
56 views

What should I use for consequent AES key derivation?

I am writing a small chat program to explore some methods and concepts in cryptography and currently I am using a shared AES key tunneled with RSA which upon further reading revealed many flaws both ...
2
votes
1answer
118 views

How to safely derive a value from a secret?

I have a use case of symmetric encryption with a single-use random key K known only by the sender and the receiver: In my scheme, Bob is able to send beforehand a tiny amount of information to Alice. ...
6
votes
2answers
651 views

Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?

I have a following use case: User has his master public (sk) - private (pk) key pair (Ed25519). In DB we store a public key. Is ...
2
votes
1answer
50 views

Protocol that generates keys every 2 minutes using KDC

I am using a Key Distributed Center (KDC) and a key distribution protocol such as Kerberos. In order to limit the amount of ciphertext produced with the same key, I want to renew the session keys ...
4
votes
1answer
50 views

Is there an advantage to using a hash in combination with a key-derivation function?

Note: This question was originally asked at Information Security Stack Exchange, but was moved here due to a topic overlap. It is currently recommended by OWASP to use an adaptive key-derivation ...
2
votes
0answers
67 views

Derivable encryption key - BIP0032 parallel

I wish to find an asymmetric encryption algorithm that supports key derivation, BIP0032 style. Meaning that I have some SEED [PRIV] and I give someone some public data [PUB], then given new public ...
2
votes
0answers
73 views

Is my deniable encryption scheme reasonable?

I was experimenting with RubberhoseFS, but since it is very hard to compile on anything modern, I decided to implement my own version, stripped of many unnecessary features. Namely, my implementation ...
3
votes
1answer
85 views

Can this key revocation scheme using hierarchical deterministic keys work?

Assume I am working with crypto that supports hierarchical deterministic key generation, Bitcoin/Ethereum keys using secp256k1 is one example. There is a decentralised key registry where users ...
1
vote
1answer
70 views

Continuous logarithms in cryptography

Cryptographic procedures seem to almost exclusively use discrete logarithms rather than continuous logarithms. Hence, I assume there are good and sound reasons for this. In essence, answers provided ...
5
votes
1answer
118 views

Is It Safe to Reuse the Same Salt in Bcrypt Password Hash (Specifically for Chaining Hashes)

As explained in my previous question, I want to develop a scheme which would be able to increase the password hash strength without the user password. According to Thomas Pornin it should be safe to ...
2
votes
1answer
66 views

For two LUKS volumes made with the same password, can stealing the encryption key from one volume allow access to the other?

A running computer has two LUKS volumes that were made with the same password. One volume is open (key is in RAM), the other is closed. If the running computer is stolen, is the closed volume safe? ...
2
votes
1answer
62 views

Are there any known security issues when doing the following chaining of BCrypt Hashes: 'bcryt(bcrypt(user-pw, work-factor1), work-factor2)'

I am currently developing a protocol which would be able to "upgrade" the strength of a bcrypt password hashes without the knowledge of the user-password so a system may upgrade it without user ...
1
vote
1answer
86 views

Why does DH-EKE require that public keys be indistinguishable from random?

The introduction to SPAKE pre-authentication states: Diffie-Hellman Encrypted Key Exchange (DH-EKE) is the earliest widely deployed PAKE. It works by encrypting the public keys of a Diffie-Hellman ...
1
vote
1answer
95 views

What are the disadvantages of XOR key derivation?

Assume a 256-bit Key and a 256-bit Salt, with uniformly distributed entropy, both fully independent. Assume ...
2
votes
1answer
148 views

KDF based on X9.63 vs. NIST SP800-108

What is the difference between KDF based on NIST SP800-108 vs. the older one in ANSI X9.63? When should one be selected over the other? Thanks.
2
votes
0answers
42 views

Why would one split HKDF output into multiple parts instead of expanding it multiple times

Reading the implementation details of Signal's approach on double ratchet algorithm I noticed the following key derivation procedure for using AES-CBC with HMAC: HKDF is used (...) to generate 80 ...
4
votes
0answers
58 views

Upgrading key derivation by adding a XOR with a known value

In general keys for password based key derivation are derived from a password hash such as the old PBKDF2 function or Argon2, possibly followed by another derivation function to derive data and ...
1
vote
2answers
108 views

Key derivation: bit lengths

This is a follow-up question to HKDF: ikm, salt and info values Based on the feedback, I have now decided to implement my key derivation for AES-GCM-256 file encryption roughly as follows: ...
2
votes
1answer
147 views

HKDF: ikm, salt and info values

As indicated at Key generation for AES-GCM-256 file encryption I'm currently working on a file encryption software. In the above thread it was suggested that, for performance reasons, I use a ...
3
votes
1answer
158 views

Where can I find official test vectors for NIST SP 800-56C r1 Single Step KDF

NIST 800-56Cr1 describes a single and two (extract-expand) step KDF designed for use in key agreement routines. NIST declares that HKDF (RFC5869) is a version of the two-step variation so test vectors ...
0
votes
1answer
52 views

ED25519 Child Key Derivation

Let's say I generate a keypair for a user with go's ed25519 package: pub, private := ed25519.GenerateKey(nil) And I want to generate additional child keys as ...
3
votes
1answer
115 views

Asynchronous Ratcheting Tree and modern group key agreements: Why left balanced-tres used?

Nowadays the group key agreements are based upon tree-based ones such as Asynchronous Ratcheting tree. Especially the latter one is constructed upon left-balanced tree. So I keep wondering what ...
1
vote
2answers
124 views

Why use HKDF for key derivation even it's not time demanding?

KDF such as scrypt is memory (cpu) demanding so that the attackers cannot quickly decrypt the key. Why use HKDF? What's the application of it? If the attacker knows the input space of HKDF, and ...
2
votes
1answer
64 views

How to encrypt sensitive files in a business application? Is it needed?

I'm currently working on a business Java application, and we store sensitive files related to our users. What is the appropriate approach to store them securely? Is it viable to encrypt/decrypt all ...
3
votes
2answers
160 views

KDF Salt: How/When is it Okay for it to be public?

Post Structure: Prior source material studied Question & Details Assumed threat model Example Assumptions Clarifications Prior source material studied 0.1. RFC 2898 0.2. HAC (Handbook of ...
1
vote
1answer
45 views

A feasible approach for AEAD on an ethernet link?

The setup is shortly this: There are two custom switches (think of an FPGA for example), both are handling 10-100 Gb/s orders of traffic from their outside facing interfaces. This is normal traffic. ...
3
votes
1answer
150 views

Reasonable Password Entropy given a certain Set of argon2 Parameters

I followed the recommendation of choosing threads, memory consumption and the number of iterations (in that order) on my machine. But now I wonder which passwords (by means of entropy) are actually ...
8
votes
2answers
981 views

Why do some key derivation functions (like PBKDF2) use a salt?

Let me start by explaining my understanding of the various concepts involved in this question: Salt: Random bytes of data used as secondary input for a password hashing function, like so: ...
5
votes
1answer
108 views

Login security and plaintext of a password stored in Argon2i to derive a key via halite safe?

I'm using Symfony 4. I have set parameters on all my Argon2 stuff below so that it takes 1s per iteration. This website is supposed to encrypt HIPAA information. Basically I have a table like this <...
1
vote
1answer
156 views

Key generation for AES-GCM-256 file encryption

I am currently working on a file encryption software that works via AES-GCM-256 and I am looking for feedback on the encryption key generation process I intend to implement. So far, I have come up ...
2
votes
0answers
30 views

Use derived keying material as key for stream cipher

Section 7.3 of SP 800-108: To comply with this Recommendation, the derived keying material shall not be used as a key stream for a stream cipher. Footnote: The level of security provided by ...
1
vote
1answer
67 views

Why use a date-dependent substring of a pre-shared key instead of just the key?

I've recently come across a situation where one system passes an encrypted payload to another system. The payload is encrypted using a pre-shared key. However, instead of just using the key itself, a ...
3
votes
1answer
115 views

Key derivation: Does it make sense to use KDF and PRF consecutively?

I'm in a project, where the output of a Key Agreement algorithm (uses ECC) is used as input for a KDF, and the output of the KDF (X9.63 KDF) is consecutively used as input for a PRF (CMAC) to ...
1
vote
0answers
41 views

Is there hierarchical key generation that completely tolerates leakage?

Is there a hierarchical key construction algorithm that achieves forward/backward privacy with any (unlimited) leakage of private non-master keys? What I mean is that if there's an unbounded number ...