Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
2 votes
2 answers
57 views

What AES mode does the CMAC use in Secure Channel Protocol 3 (SCP03)?

I am looking to verify a card cryptogram sent from a smart card chip in accordance with SCP03. According to the SCP03 spec, the CMAC is used to generate a MAC to authenticate messages sent to/from the ...
user avatar
0 votes
1 answer
28 views

Can deterministic wallet be seen as Key Derivation Function?

From Deterministic wallet: A deterministic wallet is a system of deriving keys from a single starting point known as a seed. From KDF from Wikipedia: In cryptography, a key derivation function (KDF)...
user avatar
0 votes
2 answers
71 views

Are Block Ciphers Pseudorandom functions? [duplicate]

I am reading this page on wikipedia on Key derivation function here where it states: In cryptography, a key derivation function (KDF) is a cryptographic algorithm that derives one or more secret keys ...
user avatar
0 votes
1 answer
32 views

Use of HKDF to get shorter key than digest length

I wanted to know, having studied HKDF's RFC 5869, if it is a perfectly fine example of use to derive a key using HKDF (Extract & expand) when the key to be derived has a shorter length than the ...
user avatar
4 votes
1 answer
306 views

"Oblivious" Argon2id? (or comparable KDF/KSF)?

Is it possible for a client to send a blinded password to a server, so that the server does key derivation+stretching on that blinded value, but the key can then be unblinded by the client? ...
user avatar
  • 287
1 vote
1 answer
161 views

Why does the RFC version of HKDF-Expand start the counter at 1?

In RFC 5869, the definition of HKDF-Expand is given as follows, with the terminating counter value ranging from 1 to (presumably) 255: ...
user avatar
1 vote
1 answer
71 views

Does deriving a key from a master key and then encrypting with AES-GCM increase the lifetime of the master key?

Suppose that we have a symmetric 256-bit master key, and we want to encrypt using AES-GCM with random IVs. I understand that with random IVs, the lifetime of the master key is 2^32 in order to conform ...
user avatar
0 votes
1 answer
63 views

Sharing RSA private keys using key exchange algorithms like Diffie–Hellman Algorithm?

Me and my friend would like to login to an SSH server using the same private RSA key. However, we don't want to transmit the key over the internet, for security. I am thinking if it's possible to ...
user avatar
0 votes
1 answer
128 views

Is AES GCM with PBKDF2 100k iterations still ok as of 2022?

Is using AES GCM with PBKDF2 and 100 000 iterations still considered secure as of 2022? In our threat model, if we ignore the risks linked to quantum computing, is this secure? Here is an example ...
user avatar
  • 481
1 vote
1 answer
68 views

Salt value in scrypt algorithm

I see there are a lot of questions relating to handling of a salt value but nothing I have seen so far has cleared the following question. When using a KDF such a scrypt, I believe the value of the ...
user avatar
  • 55
2 votes
1 answer
68 views

How to derive two keys from one password with Argon2id

I'd like to derive two independent 256 bit keys for symmetric encryption from a user password. I'm using Argon2id as the password-based key derivation function. I'm planning to do the following: ...
user avatar
4 votes
1 answer
156 views

Can a digital signature be used to generate a key for AES encryption?

I am looking to see if using a digital signature is a secure and reasonable way to generate a key for AES encryption. To flow would be as follows: A user signs a message ...
user avatar
  • 55
1 vote
0 answers
33 views

How does the indexing in Argon2 work?

I am reading the original paper of Argon2 authors and I can understand the algorithm except the indexing part. Can anyone explain two things: the indexing process and the mapping $J_{1}$, $J_{2}$ to ...
user avatar
1 vote
1 answer
63 views

Question about Harden and Normal Key derivation

I am reading about Hardened and Normal child key in chapter 5 of the book "Mastering Bitcoin" by Andreas, along with this detailed thread and BIP-32. Here are some of my understanding about ...
user avatar
1 vote
1 answer
78 views

Do I need a salt when deriving new keys with HKDF if master key is strong? Is a global salt ok?

Let's say I have a master key and want to use it to derive new keys to use for encryption, using HKDF. I'm a bit confused regarding the use of salt though. I have seen other posts about it here but I ...
user avatar
  • 111
0 votes
0 answers
67 views

I am new KDFs. I need backgrounds of KDF and ASN x9.63, HKDF using Java

JavaCard 3.1 introduces this KDF as part of this release. Can someone help me in understanding this topic clearly? (KDF ANS X9.63). I need some parameters informations. What is shared secret and ...
user avatar
0 votes
1 answer
58 views

Key Derivation/Hashing Function with Fast Comparison

Is there a key derivation/hashing function (that has any real value) that fulfills both of these criteria: Slow to compute the hash Fast to verify the hash based on the input string (not given a ...
user avatar
1 vote
0 answers
71 views

How to compose (H)KDF, Encryption and (H)MAC

For legacy reasons one of my systems doesn't have the option of using an AEAD mode, we are restricted to AES in plain CBC or CTR mode plus a MAC. A typical task is to transfer data from one node to ...
user avatar
2 votes
2 answers
157 views

What's bad about idea of public-key/one-time-pad hybrid cryptosystem?

As i know, generally nowadays hybrid protocols are more widely used than either symmetric or public key cryptosystems separately. I read that public key system is used to exchange and share secret via ...
user avatar
2 votes
1 answer
81 views

Questions: Argon2, its internal state and security of it when generating keys larger than 256/512 bits

Let's suppose I want to use a cipher with a large key size, such as ISAAC that supports 8192 bits ogf key. I can hash with sha-256 or sha-512 and iterate until reaches the key size but I won't get ...
user avatar
1 vote
0 answers
108 views

How secure is it to use a 128-bit random seed to derive a 256-bit key for seeding key-pair generation?

We are developing an open-source peer-to-peer app, Mapeo, designed for users with low technical experience (and no email or phone) to collect data in offline environments. We are generating their ...
user avatar
  • 11
3 votes
2 answers
227 views

Are PRNGs Key Derivation Functions?

PRNG is a mechanism to produce randomness from an initial random seed, so basically a way to derive more secrets from one secret. Looking at the Wikipedia entry for KDF you find In cryptography, a ...
user avatar
2 votes
2 answers
389 views

How is Argon2 used for key derivation? [duplicate]

By my understanding, a key derivation is when you take some data, say a password, and use a function to convert it into a number that can be used as a secret key in say elliptic curve cryptography. ...
user avatar
4 votes
1 answer
118 views

How to securely derive a key from a list of sorted random bytes?

Is it possible to derive a secure cryptographic key from an array of sorted bytes, assuming the bytes themselves were generated in a secure manner (say, from quantum phenomenon)? What would be the ...
user avatar
  • 51
3 votes
2 answers
459 views

Difference between Non-uniformly random and Uniformly random

I am reading up on Key Deriving Functions (KDF) and in a section of the Real-World Cryptographic book by David Wong, a comparison is being made with Pseudorandom number generator (PRNG). And one of ...
user avatar
  • 133
1 vote
0 answers
61 views

Memory-hard key derivation algorithm where all requested memory is needed at every time moment

Background. All MKDF (memory-hard KDF) algorithms that I know (Scrypt, Argon2, Balloon) don't really require all the memory at every moment during the run time of algorithm's implementation, but ...
user avatar
  • 519
1 vote
1 answer
56 views

Generate unique random values for unqiue input values

I'm going to generate unique random values based per a range of unique input values. In other words I have range of input values which these numbers are part of a series (like a range of serial ...
user avatar
  • 165
-2 votes
1 answer
43 views

Problem understanding the difference between passphrase and keyfiles

Ok, so I have read a few different articles on subject and am maybe just just having problems understanding the point of view from the program I am using or maybe not IDK. Anyhow, ill get into it. ...
user avatar
1 vote
1 answer
135 views

Estimation of the entropy of keys derived from truly random numbers

NOTE: This question is based on my assumption that $X$ is a "truly random number" if and only if it's length measured in bits is equal to its entropy measured in bits. In other words, when ...
user avatar
1 vote
3 answers
83 views

Derivating random numbers from random numbers

If I have a "truly random number" $K$ of $L$ bits (whatever "truly random" means... is it a value from a normal distribution a truly random number, or only uniform distributions ...
user avatar
1 vote
1 answer
45 views

Rivest Cipher 6 (RC6) Key Scheduler

I am trying to understand the Key Scheduler used in RC6 and I have a total of 3 questions. The RC6 Wikipedia page says that the only difference between the RC5 and RC6 key scheduler is that more words ...
user avatar
  • 21
3 votes
2 answers
126 views

Don't human generated passwords used with key derivation functions reduce the security of symmetric encryption?

The key size for AES is chosen as 256 because that's considered the minimum keysize which can protect against a brute force attack - i.e. $2^{256}$ tries. However, in practice, for a lot of ...
user avatar
  • 1,637
0 votes
0 answers
31 views

User key management scheme: BYOK vs. client only keys vs. a mix of both

We are designing a web app where users can share documents with each other. The ultimate goal is to achieve zero trust needed by the users, i.e. client-side encryption makes sure that the servers (or ...
user avatar
7 votes
2 answers
1k views

Do I need to sanitize user input to scrypt, or to PBKDF's in general?

I'd like to allow the user to supply a password as input to some PBKDF, which I will use to construct a key for file encryption (currently using aes-256-ctr. It may change as I learn more). I am ...
user avatar
1 vote
0 answers
60 views

Combining Post-Quantum and Classical KEM

I came across this paper "Hybrid Key Encapsulation Mechanisms", were three methods are defined that allow a secure combination of a classical key encapsulation with a post-quantum key ...
user avatar
  • 276
0 votes
0 answers
50 views

Saving highly sensitive data in US cloud - what encryption would you use?

We have a cloud-based application running on AWS servers and are looking for a way to store highly sensitive user data there without giving AWS the possibility of exposing our data to the US ...
user avatar
2 votes
3 answers
483 views

Efficient way to pick an array index by using a, say, 64 bit random number?

Say, I have uint64_t rand = <some random number>, and char array[20] = .... My goal is to pick an element in ...
user avatar
  • 519
1 vote
1 answer
75 views

HKDF with predefined IV

Can I generate from a randomly generated key let say three other keys via HKDF with predefined IVs, eg. Sha-256 of "apple", "banana", "pear"? My use-case is an app that ...
user avatar
0 votes
0 answers
56 views

Managing master keys used in PBKDF2 and HMAC (store, rotate)

My use case: I have few master keys, I use each for a specific operation (e.g. one for encrypting user's data and another for creating JWT signatures etc...). I use these master keys in two specific ...
user avatar
2 votes
2 answers
119 views

AWS signature v4 key derivation

Generating Authorization header with AWS signature v4 involves deriving signing key as follows: https://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html ...
user avatar
1 vote
0 answers
23 views

Can the hash of a PKCS1 v1.5 RSA signature be used as a key derivation function?

I know this sounds crazy, but hear me out. As a follow-up to Can the AES-GCM authentication tag be used as a key derivation function?, I'm also considering more creative solutions to derive unique (...
user avatar
  • 472
2 votes
1 answer
123 views

Can the AES-GCM authentication tag be used as a key derivation function?

I want to build a deterministic key derivation tree, where the root is stored securely in a centralized service and the leaves are embedded in a multitude of devices. When a device wants to ...
user avatar
  • 472
2 votes
1 answer
254 views

CTR overlap with random IV

Problem: I'm slightly worried about counter repeats in CTR mode when using random IV. If you split it (like half IV, half counter), it increases chances of same IV (it is smaller) and limits message ...
user avatar
  • 1,322
-1 votes
1 answer
38 views

Encrypted file sharing with deterministically generated key from user password

Background info: I need to encrypt files in a enterprise workspace with several users. The goal is to encrypt files directly from browser to be saved on a server and each user could decrypt files for ...
user avatar
  • 11
3 votes
1 answer
117 views

Is PRF XORed with its key still a PRF? (always)

$\forall k \in \{0,1\}^n,m \in \mathbb{M},F_k(m)$ is defined as follows: $F_k(m) = F'_k(m) \oplus k$. It is known that $F'_k$ is a PRF. Note: 𝕄 is the message space and it's assumed that the key $k$ ...
user avatar
1 vote
2 answers
86 views

is it safe to combine scrypt with other hash algorithms?

I'm currently writing a file encryption program, and I designed this scheme to derive a key from user input password: ...
user avatar
0 votes
0 answers
40 views

Why do you need to apply hash over DH shared key? [duplicate]

I`ve read multiple times that it is not safe to use the shared key resulted from DH key exchange directly and that you need to do a KDF or hash over it and then use the result as a key. Why is it not ...
user avatar
0 votes
0 answers
130 views

Adding salt to Blake3 Key derive function

According to the whitepaper, Blake3 can be used as a key derivation function (function key_derive). Currently, as a key ...
user avatar
  • 235
1 vote
1 answer
114 views

Am I using these key derivation functions correctly?

I am a bit confused about key derivation functions. I am trying to use the argon2 KDF from the passlib python module to do the ...
user avatar
0 votes
1 answer
278 views

AES Password Based Key Derivation Iterations

I have been writing my own implementation of the Advanced Encryption Standard with cipher block chaining in python3 for the last several months, mimicking the OpenSSL command line interface. I can ...
user avatar
  • 1

1
2 3 4 5
12