Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
1
vote
2answers
43 views

Static salt for PBKDF2, but unique salt for HKDF?

Hypothetical. Lets say you have an application where you generate a master key from a user password using PBKDF2 (static salt) and then use the master key to derive two passwords keys for an encrypt-...
2
votes
1answer
57 views

How to encrypt many files with AES-GCM, without running the key derivation function each time?

Linked question: AES encrypting multiple files With a password, I have 100k files to encrypt. (Maybe 100k files today; or maybe 50k today, 10k tomorrow, and 40k ...
1
vote
1answer
70 views

Zerologon question - AES-CFB8

I was reading the zerologon whitepaper by secura named: Unauthenticated domain controller compromise by subverting Netlogon cryptography. I'm trying to understand the zerologon attack. The issue is ...
0
votes
0answers
30 views

What's the tightest time-space trade-off law for unbounded time and space?

Let's say that my CPU can be made arbitrarily faster (or I can become arbitrarily patient waiting for the CPU to complete its task), and let's say that my memory (e.g. RAM) can be made arbitrarily ...
3
votes
1answer
53 views

Is PBKDF2 with 1 iteration acceptable for a simple random key expansion?

I have a 128 bit randomly generated key. I need to expand this key to 512 bits to use with an existing encryption library that does AES-256 encryption in CBC mode with HMAC-SHA256 authentication. The ...
1
vote
1answer
92 views

How to estimate the maximum computational cost bound for Key Derivation Functions (KDFs) before it becomes useless security-wise?

From my understanding of Key Derivation Functions (KDFs), e.g. scrypt, Argon2, etc, we can tune their parameters such that it eventually becomes harder for an attacker to brute force a password-to-key ...
1
vote
1answer
61 views

Using a nonce as a salt for key derivation

I'm currently playing a bit with PyNaCl (python binding to libsodium) and I want to use the secretbox for symmetric encryption between two parties, which means they both must know the (in my case ...
2
votes
1answer
57 views

Why shouldn't cryptocurrency hash algorythms, resist side channel attack?

2015's Argon2 publication suggests that cryptocurrency hashing like password hashing on backend servers should not be subject to side-channel attack: Argon2d is optimized for settings where the ...
3
votes
1answer
104 views

How does the Concat KDF work?

I am writing an application using JSON Web Encryption with ECDH using the X25519 Curve. The RFC says that ECHD-ES derived secret is run through a Concat KDF. Given ...
3
votes
2answers
255 views

If P256 ECDH shared secret contains ~128 bits of security, does using first half of the secret (= 128 bits) contain only 64 bits of security?

There's this rather popular open source project (I'd rather not name it before possible responsible disclosure) that computes a P256 ECDH shared secret (256 bits) and uses only first half of it, rams ...
1
vote
1answer
87 views

How to choose parameters for Argon2 for password vault

I'm creating a password vault and I'm planning on using Argon2id to derive the master key from the master password. For encryption I'm planning on using XChaCha20 with Poly1305. To be clear: a set of ...
0
votes
1answer
38 views

Using platform-level RNGs for key derivation with hash functions like BLAKE3?

So I've read stack overflow questions like this one. What I'm wondering is a bit more specific though: I'm really liking what I'm seeing with BLAKE3. (I suspect that this hash function is relatively ...
0
votes
1answer
30 views

Why is SKEYSEED derived using the nonce as a key?

In IKEv2, SKEYSEED, which is used to as a seed for generating the rest of the keys, is generated as SKEYSEED = prf(Ni | Nr, g^ir)...
0
votes
1answer
37 views

Is it possible to derive a constant value from different signatures of a private key?

For example perhaps deriving the same PRF from RSA signatures on different messages from a (not known) private key? Struggling to find the proof of why not.
2
votes
0answers
45 views

Security problems if ECDH and ECDSA use the same key [duplicate]

Hy! I want to use an EC key for ECDH and ECDSA too. Using the same key does compromise the security of the key in a cryptographic / mathematical sense? I read a lot in this theme, but I found nothing ...
0
votes
1answer
56 views

Can I use the same key pair for authentication and Diffie-Hellman? [duplicate]

Assume Alice has a key pair $(A, a)$ and Bob has a key pair $(B, b)$, where $A = Ga$ and $B = Gb$. In general, the basic rule of crypto says that we should not use the same key for different ...
1
vote
1answer
43 views

Can I compress $192$ byte key into $16$ or $32$ bytes which can be later used in KDF to recover full key

I have a key $k$ which is $192$ bytes long. Is there a secure way to first compress this key into $16$ or $32$ bytes, but in such a way that later given those $16$ ($32$) bytes I can use a key ...
2
votes
0answers
80 views

For TCG-Opal drives, which password is used to derive KEK?

SEDs use a user password (PIN) to generate KEK by a KDF algorithm. The KEK is then used to encrypt the MEK (where MEK is internally generated in the drive). But TCG-Opal drives have 9 locking-ranges ...
3
votes
1answer
81 views

Good key update algorithms for key evolving schemes

In schemes like SAKE(Symmetric-key Authenticated Key Exchange) , the master keys (used to authenticate parties and generate session keys) are evolving, ie undergo transition $K=update(K)$. What is a ...
0
votes
0answers
43 views

is it safe to do public key to public key derivation with Ed25519?

Deriving a public key from a public key in Ed25519 is possible, some algorithms are available. My question is why there are so few implementations compared to secp256k1 for example. The extra checks ...
6
votes
2answers
232 views

Using XOR to derive a data key for ECIES

I have been thinking about a rather simple enhancement for (EC)IES / RSA-KEM. The scheme would allow you to encrypt data while the calculation of the session / data key can be performed afterwards or ...
2
votes
1answer
62 views

Generate AES key from weak string

I'm trying to generate AES256 key from user input password. The size of the password can be anything from 4 bytes long to 32 bytes long but let's assume it is the smaller one. My API support either : ...
0
votes
0answers
37 views

Any gotchas when deriving a symmetric key from two seeds?

Consider a connection protocol where, after jumping through several other hoops, Alice and Bob know each others' public keys; and they now want to do a RSA-handshake-kind-of-thing to come up with a ...
2
votes
1answer
34 views

What are the randomness requirements for inputs to PBKDF2?

I need to generate one 160-bit HMAC-SHA1 key for each user in my system. Can I use the username as the input to PBKDF2 function to generate the key? Is it safe to use known values like username as ...
2
votes
0answers
76 views

How hard is it to link a hardened BIP32 child public key to it's parent public key?

The BIP32 spec says this in the security section: ...
1
vote
0answers
25 views

How to handle IKEv1 and IKEv2 diffie-hellman shared secret bits length not multiple of 8?

In Cryptographic Algorithm Validation Program for KDF document, here, page 9, it says "If a field size that is not a multiple of 8 bits, the shared secret is represented by a string of bytes that ...
0
votes
0answers
54 views

How to Derive a Child RSA Key Pair from an Existing RSA Key Pair?

I want to understand how, using standard tools like openssl (or similar), to derive a child RSA key pair from an existing RSA key pair. Additionally I would like the derived key to contain a ...
0
votes
1answer
89 views

KDF for generating RSA and ECC keys from a 2048 bit secret

Do KDFs exist for generating RSA and ECC keys from a 2048-bit random secret?
0
votes
0answers
76 views

Are My Answers to This AES Question Correct?

Question I am extremely new to cryptography and AES and so I am not confident that I did this question orrectly. Please can you check my answers and let me know if anything jumps out as incorrect, ...
1
vote
0answers
64 views

KDF options for a ECDH shared secret

the answer to this question suggests that the x-coordinate of an ECDH shared secret is itself usable as an encryption key without apply a KDF.... if so, then what additional security is provided by ...
5
votes
1answer
436 views

Is it necessary to stretch/derive an AES key when I already have enough bytes from a 'cryptographically secure RNG'?

I'm using AES-CBC-256 with PKCS#7 compatible padding. I already have 32 bytes that come from a 'cryptographically secure random number generator'. In this scenario, does it make sense to use PBKDF2 to ...
1
vote
2answers
91 views

Meaning of the term “Key Material”

I am reading specifications from my client that focuses on the topic of security. In these specs, the term key material has appeared many times. I used Google to look for what the term means. ...
1
vote
1answer
49 views

Secure password reset

In my model I use two different keys, one for authentication and the other for the encryption / decryption of the data that the user saves, each derived from the master password with a KDF function. ...
0
votes
2answers
73 views

KDF and salt storage

Regardless of the KDF I will use, let's imagine that I have to generate two keys, one for authentication and the other for encryption (which will always remain on the device that generates it until ...
6
votes
1answer
203 views

Is Argon2id safe from the discovered Argon2i issues?

So far, as I understand it, two ways to reduce the complexity of Argon2i have been found, one of which was fixed in Argon2 1.3, and one of which is still unfixed but is not a practical problem given ...
0
votes
0answers
65 views

Apply HKDF After DIffie-hellman Key Exchange

Im trying to use HKDF after DIffie-hellman key exchange. However, i got stuck on HKDF part. ...
0
votes
1answer
48 views

How to apply a block cipher to (large) packetized communication when packets can get lost/erased?

In light of current events (Zoom getting strong headwinds for using AES-128 in ECB mode), I was wondering what the general approach is to packetized data encryption, where the packet length (UDP for ...
1
vote
1answer
52 views

Computationally expensive key derivation whose difficulty is asymmetric

I am looking for a primitive or a construction that meets the following requirements. Is such a construction (a) theoretically possible, and (b) in existence right now? Given are: a long secret $X$ ...
2
votes
5answers
184 views

How passwords are fed to key derivation functions?

Suppose I want to encrypt data, send it over the network, and decrypt it on the receiver side. I know the elegant way to do this is by using a symmetric key to encrypt the data and an asymmetric key ...
1
vote
1answer
51 views

DHE parameters: which parameters need to be random each time?

In DH key exchange, first, both parties need to agree on a generator $g$ and prime $p$. After that each party computes its key (party A: $g^a \bmod p$) and (party B: $g^b \bmod p$), then they exchange ...
2
votes
1answer
165 views

ChaCha20-Poly1305: Can my salt/pass for a KDF also be the nonce?

I have a PSK. I don't want to use it directly. I want to pass a "salt"/password into a KDF and get a new key for authenticated encryption with ChaCha20-Poly1305 . I need to give the other side the ...
0
votes
0answers
29 views

Using PSK starting a new session, encrypt the new session key with old, or sign a derivative to be used on the old key?

I have two endpoints that go through a middleman. Both have a pre-shared and secure key, 16bytes to be used with ChaCha20-Poly1305. Extremely constrained device. No packet larger than 100 bytes total. ...
1
vote
1answer
207 views

TDES (Triple DES) DUKPT decryption

We have a POS (Ingenico) that uses DES3-CBC encryption using a derived key. It sends encrypted data, and 10 bytes size Key Serial Number (KSN). I tried to use ...
0
votes
0answers
69 views

KDF3 - implementation explanation

An old project that I did not code is using the KDF3 algorithm, but I struggle to find an explanation about the way this key derivation algorithm works. I know that this algorithm is part of the ISO-...
0
votes
2answers
171 views

Is it safe to use a deterministic salt as an input to KDF (Argon2)?

I'm prototyping an app that uses client-side password hashing in order to hide the "real" account password from a server (the server hashes any recieved password anyway, so no plaintext records in the ...
1
vote
1answer
66 views

Derived keys usable by threshold signatures

Suppose there are $n$ members in a $(t,n)$ threshold signature scheme. The global secret key $sk$ is not known to any single party, as the keys are generated distributed. The parties are able to ...
0
votes
0answers
59 views

BIP32 Extended Key to EC Private and Public Key Pair

We are working on an application in Android using Java. In our project, we used to generate EC key pairs (of size 384 bits) using SpongyCastle - an old Android version of Bouncy Castle. The problem ...
0
votes
0answers
16 views

Scrypt cipher - known vulnerabilities and cryptanalysis? [duplicate]

there is a Scrypt cipher which is used for exmaple by some cryptos like LItecoin for their mining algorithm. I never heared of scrypt. I know eg SHA256 which is well analyzed and considered as secure ...
0
votes
1answer
76 views

Multiple random keys vs multiple keys derived from master key

If Alice is going to share a symmetric encryption key and a kmac key with Bob using asymmetric encryption (sign with static key, encrypt with ephemeral keys - an authenticated KEM), what are the ...
5
votes
1answer
982 views

Multiple AES Key Derivation from a master key

I need cryptography advice regarding this issue. Kamus is a service that encrypts secrets for applications running on Kubernetes. When using AES (actually, Rijndael) symmetric encryption, Kamus uses ...

1
2 3 4 5
11