Questions tagged [key-derivation]
In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.
606
questions
0
votes
0
answers
21
views
Double Ratchet at Signal: Which impact have the input_key and input_data to a KDF-Chain?
At the documentation of the Double Ratchet Algorithm from Signal (link), at section 2.1 they define the KDF function they use with its properties.
I am referring to the following:
"We define a ...
- 51
4
votes
0
answers
38
views
What is the impact of leaving a salt used in HKDF open to attacker control? [duplicate]
RFC 5869 for HKDF says "an application needs to make sure that salt values are not chosen or manipulated by an attacker".1 Soatok also discusses some nuances in choosing salts for HKDF.2 ...
2
votes
1
answer
284
views
Deriving secret keys vs generating and encrypting them
Suppose one has a password manager, based on symmetric cryptography, that requires a master passphrase to be unlocked. Argon2 is used for deriving a secret key from the master passphrase.
I need ...
- 123
1
vote
1
answer
45
views
Can HKDF be used in place of a cryptographic hash function?
For context, I'm making a non-production grade reference implementation of the balloon hash function using the Web Crypto API. In order to make it less susceptible to certain attacks on common memory ...
- 425
0
votes
0
answers
66
views
Cracking 2-Key Triple DES
I've been given that an attacker has a 2-Key Triple DES Cracker that is capable of performing 10$^{24}$ encryptions per second and have subsequently been asked how long it must take before the ...
28
votes
4
answers
6k
views
Is there a hash function that's more expensive for an attacker than for the server?
Say a server wants to hash a password $p$. It would use a secure hash function $H$ and a unique salt $s$ to hash the password as $H(p,s)$. If one has access to the salt, each password candidate ...
- 425
1
vote
1
answer
53
views
Understanding symmetric encryption security in relation to password-based key derivation
Here are some assumptions on which the question is based. If anything is wrong with this, please point this out straight away:
Let's say I have a file I want to encrypt with AES256 symmetric ...
- 13
2
votes
0
answers
30
views
Deriving multiple deterministic keys in a Schnorr Multisig setup
Let's say that Alice and Bob have generated truly random private keys $a$ and $b$ and want to use them in Schnorr signing. They calculate $X = g^a \cdot g^b$ as their mutual public key. For whatever ...
- 21
5
votes
1
answer
319
views
For password-based authenticated encryption is it OK to derive the auth key from the crypt key with 1 iteration?
That is, in the case where the iterations value is a large number, since iterations are costly is there a difference in security of doing something like this, where two separate derivations are ...
- 153
2
votes
2
answers
132
views
Can you restore a private key from biometrics?
My understanding is that iOS FaceID/Fingerprint for example use an underlying mathematical representation of the biometric features.
Is it possible to generate a key pair from this representation and ...
- 123
0
votes
0
answers
75
views
Old openssl version does not support -iter or -pbkdf2, how does it derive the encryption key for AES?
When using openssl or libressl to encrypt or decrypt data with AES, I typically specify ...
- 1,387
4
votes
2
answers
168
views
Deriving private keys from a signature/HSM
I have access to an HSM that can sign messages but doesn't have a way to expose the private key. The signatures are deterministic (RFC 6979). Another application only works with ed25519 signatures ...
- 43
4
votes
2
answers
428
views
Does combining multiple PBKDF2 keys result higher iteration count when using same password but different salts?
I did some experimenting with web subtle crypto.
I derived a key using PBKDF2 with SHA-512 and 100 000 iterations and timed it.
Doing same with 200 000 rounds doubled the time as expected.
Then I did ...
- 43
3
votes
1
answer
569
views
Why does SHA-256 have any to do with scrypt?
I was reading the Wikipedia page for scrypt because I wanted to learn more about it and I came across their pseudocode for the algorithm. What confused me was the following line:
I don't understand ...
- 190
0
votes
0
answers
43
views
Client Side Encryption For Web Apps
I want to build something where web clients encrypt some data server side and store it with me. However, I am not sure how to manage the user keys - ideally they can just sign in with social to access ...
- 1
1
vote
1
answer
56
views
Is there any point in extending an 80-bit key before using it for HMAC-SHA256?
I have been asked to make a HMAC-SHA256 password digest from:
a password
some salt, and
an 80-bit secret key.
I've been advised that I should be using a key of 256 bits or more for HMAC-256.
The key ...
- 771
2
votes
1
answer
90
views
Benefit of salt in KDF like Argon2
I don't understand why I need a salt for Argon2 if Argon2 is only needed as a KDF for a password which is then called AES. At the end neither the password nor a password hash is stored. Only the data ...
- 21
0
votes
2
answers
141
views
Argon2 derive two keys from one password
This is not a duplicate, I'm asking which method is better.
I generate an encoded argon2 hash string, so it'll be stored in database to verify login passwords.
Saved encoded hash has salt of length ...
- 1
1
vote
2
answers
88
views
How are RSA and Elliptic Curve keys generated deterministically?
Going through the TPM tutorial: https://google.github.io/tpm-js/#pg_keys
The output of KDF would be some pseudo-random bytes. For RSA, the bytes might not be a prime number. For elliptic curves, the ...
- 87
-1
votes
2
answers
74
views
What is the standard checklist for designing a Key Derivation Function?
What kinds of properties does a KDF need to have in order to be considered secure? What steps should be taken during analysis to test for flaws?
In particular, I mean a KDF that is going to be used as ...
1
vote
2
answers
71
views
How is $Nb$ (number of columns) calculated in AES (Rijndael)?
The NIST publication for AES defines $Nb$ as:
Number of columns (32-bit words) comprising the State. For this
standard, Nb = 4.
In Section 5.2: Key Expansion, $Nb$ has been used to calculate the ...
- 111
3
votes
2
answers
203
views
Is a simple KMAC-128 or KMAC-256 hash secure as a KDF?
Context
I am trying to build a simple protocol for key derivation. I want to use SHA-3 family hash functions, which (as far as I understand) should not be combined with HMAC because their security ...
- 257
2
votes
1
answer
139
views
(How) can Argon2 be used to create both a hash for authentication and a secret key?
The Argon2 specs claim that Argon2 can be used both for password hashing and key derivation.
I want to generate from a single password both a hash for authentication and a secret key to use for ...
- 23
1
vote
2
answers
73
views
How do KDFs work, and what existing implementations exist?
TLDR/End goal
I want to encrypt a tree of data/files so that anyone with the master key K can decrypt everything, key K-1 can ...
5
votes
1
answer
290
views
Apple "Find My" Key Rotation
Apple's Find My technology is described in this Wired article and explains how Apple, or other third parties, are not able to decrypt location data. It mentions how the keys are rotated every hour:
...
- 153
2
votes
0
answers
55
views
Requirements for KDF and randomness extractor
What requirements KDF and randomness extractor does not have to meet, but the the hash function have to meet? I suspect that using hash functions as KDFs and randomness extractors is enough, but in ...
- 1,171
1
vote
1
answer
145
views
HKDF-Expand max output length
I'm trying to use HKDF-Expand to derive lots of keying material (> 64GB) from a pseudo-random 512 bit key.
Now according to the HKDF RFC, the maximum amount of ...
- 13
0
votes
0
answers
75
views
Can one securely use same salt and IV with different KDF-derived keys when using aes-256-cbc?
I know this is theoretically bad practice, but please bear with me…
Assuming following spec:
Salt and IV are randomly generated using cryptographically-secure RNG.
Argon2 is used as KDF so ...
- 189
12
votes
3
answers
5k
views
How much security is gained from hiding the nonce?
Public nonces can be problematic for privacy when they can be considered metadata. They can also be troublesome for security if you do things like using a hash of the message as the nonce.
PASETO now ...
- 1,128
1
vote
1
answer
111
views
Is it possible to use aes-ecb-256 decryption algorithm as customer key derivation function to generate the aes key?
I'm sorry if I'm going horribly wrong - I am new to this stuff.
My question is：
KDFC1,KDFC2,KDFC3 is defined by myself.
Key1 is come from outside .
Is it possible to use the aes-ecb-256 decryption ...
- 11
0
votes
1
answer
138
views
Should I use hash of passphrase as AES256 key
As title I have a password-like passphrase (8 chars at least) that is then hashed with argon2(with the salt is SHA256 of that passphrase).
Then use it as AES256 key along with a random IV generated by ...
- 155
0
votes
1
answer
84
views
How is the shared secret generated in IPsec using DH key generation?
I have doubt like when in the IPsec we use a DH group for key exchange. It takes a prime number and $g$ value from group bit.
How does the key exchange payload and nonce help to generate the shared ...
- 1
0
votes
1
answer
99
views
Can salt for HKDF be hardcoded within a program
i am new to cryptography , i am using article https://medium.com/asecuritysite-when-bob-met-alice/hmac-and-hkdf-df4e194752d1 for reference , while using salt with hkdf to derive multiple keys from a ...
- 1
1
vote
1
answer
100
views
Derive independent values using block cipher
Suppose having an arbitrary $GF(2^n)$ element $x$. Its distribution is unknown.
The task is to derive two $GF(2^n)$ elements $y$ and $z$, that have uniform distribution and are independent from each ...
- 208
0
votes
0
answers
57
views
i am deriving 2 keys from a single shared secret , one for encryption other for HMAC do i need domain separation in hkdf using salt?
i am deriving 2 keys from a single shared secret of 32 bytes , one for encryption using 32 byte key other for HMAC using 64 byte key do i need domain separation in hkdf-sha512 using salt?
1
vote
1
answer
154
views
to derive multiple keys from single shared secret can i safely ignore info and salt parameter in HKDF
I am using a PQ-KEM to get a 32 byte shared secret. I want to derive 2 keys , 1 for encryption of message using AES-CTR and another for HMAC-512. can I safely ignore salt and info parameter in hkdf-...
0
votes
1
answer
45
views
If attacker modifies salt used for HKDF used for splitting keys for encryption and authentication will cryptosystem be safe?
I have 16 byte shared secret , I am using HKDF-SHA256 to derive 2 ,32 byte keys , one for encryption aes256-gcm and another hmac-256 , the salt info used for HKDF are sent publicly along with the ...
1
vote
1
answer
191
views
Minimum length of salt and info for HKDF
Hi newbie here is there any minimum length for salt and info passed to hkdf based key derivation or is using 32 byte randomly generated bits for salt and info can be used for all hkdf
1
vote
2
answers
88
views
can 32 byte shared secret can be given as input to HKDF-SHA512?
since digest size of sha512 is 512 bits or 64 bytes , is it safe to use values lower than 64 bytes as input to hkdf?
I learned than hkdf uses hmac internally and input for hmac-512 is recommended to ...
1
vote
1
answer
101
views
Could you reuse the IV for AES256-GCM as salt for HKDF-SHA256?
I am having a 32 byte shared secret from a KEM , I want to use AES-GCM for encrypting messages in this process random iv has to be created , can I use this iv as salt for hkdf-sha256 to generate more ...
1
vote
1
answer
67
views
Will increasing timecost , memorycost , parallelism in argon2ID increase security in general?
currently I am using parameters for argon2ID in terms of timecost , memorycost , parallelism higher than what is recommended in RFC9106 https://www.rfc-editor.org/rfc/rfc9106.html for increased ...
2
votes
1
answer
73
views
Can raw hash be used as secret key
I am trying to use argon2 hash to derive secret key to be used for AES-GCM , in package argon2-cffi in python there is a function argon2.low_level.hash_secret_raw(secret: bytes, salt: bytes, time_cost:...
1
vote
2
answers
141
views
Is there a scheme to enforce a random seed without leaking the seed?
End-to-end encrypted web services (like cryptpad) often include a 128-bit seed in the hash part of the URL (that is not sent to the server), to derive both an identifier that is sent to the server, ...
- 113
2
votes
0
answers
56
views
What is the key-derivation used in pdf2, is there a secure option?
I recently needed (for legitimate reasons) to crack an encrypted pdf sent by a local bank. It was pdf1.7 and the password was 6 digits. cracking it with John the ripper took no time at all. In fact it ...
- 11.5k
0
votes
2
answers
72
views
Recovering original bit vectors that constituted XORed binary vectors
I am trying to unscramble received data packets. Each packet is divided into 3 parts ($A$, $B$ and $D$) with equal lengths. In every packet, each of these parts are scrambled/encrypted with an unknown ...
- 109
0
votes
1
answer
83
views
Is a static IV really less secure than an IV generated from a master key?
As an example, let's take a simple situation where AES-256-CBC with IV + MAC is used to encrypt a given plainText and offer authentication.
...
- 293
0
votes
1
answer
27
views
When would we need a bigger IV than 2 bytes when the IV is derived of a master key?
As an example, let's take a simple situation where AES-256-CBC with IV + MAC is used to encrypt a given plainText to offer both authentication and prevent identical cipherTexts.
...
- 293
2
votes
2
answers
347
views
What AES mode does the CMAC use in Secure Channel Protocol 3 (SCP03)?
I am looking to verify a card cryptogram sent from a smart card chip in accordance with SCP03.
According to the SCP03 spec, the CMAC is used to generate a MAC to authenticate messages sent to/from the ...
- 21
1
vote
0
answers
53
views
Can deterministic wallet be seen as Key Derivation Function?
From Deterministic wallet:
A deterministic wallet is a system of deriving keys from a single starting point known as a seed.
From KDF from Wikipedia:
In cryptography, a key derivation function (KDF)...
- 484
0
votes
2
answers
114
views
Are Block Ciphers Pseudorandom functions? [duplicate]
I am reading this page on wikipedia on Key derivation function here where it states:
In cryptography, a key derivation function (KDF) is a cryptographic algorithm that derives one or more secret keys ...
- 484