Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions ...

1
vote
0answers
13 views

How to choose between password derivation or encryption? [migrated]

Suppose you use a password manager having all possible features of modern password managers: encryption with a key derived from your master password, auto-filling, cloud or local storage, browser ...
3
votes
1answer
37 views

Asynchronous Ratcheting Tree and modern group key agreements: Why left balanced-tres used?

Nowadays the group key agreements are based upon tree-based ones such as Asynchronous Ratcheting tree. Especially the latter one is constructed upon left-balanced tree. So I keep wondering what ...
1
vote
2answers
51 views

Why use HKDF for key derivation even it's not time demanding?

KDF such as scrypt is memory (cpu) demanding so that the attackers cannot quickly decrypt the key. Why use HKDF? What's the application of it? If the attacker knows the input space of HKDF, and ...
0
votes
0answers
39 views

How can I reuse ed25519 derived keys for asymmetric encryption?

I want to reuse my ed25519 derived keys (more specifically: from Stellar blockchain) to encrypt simple messages, without creating any shared secret key (for symmetric encoding). So I'm not interested ...
0
votes
0answers
49 views

Public-only KDF

I need a variant of KDF (key deviation function) capable of generating public keys only. The use-case is the following: there's a master KDF, initialized by some secret data, which can generate ...
2
votes
1answer
30 views

How to encrypt sensitive files in a business application? Is it needed?

I'm currently working on a business Java application, and we store sensitive files related to our users. What is the appropriate approach to store them securely? Is it viable to encrypt/decrypt all ...
3
votes
2answers
72 views

KDF Salt: How/When is it Okay for it to be public?

Post Structure: Prior source material studied Question & Details Assumed threat model Example Assumptions Clarifications Prior source material studied 0.1. RFC 2898 0.2. HAC (Handbook of ...
1
vote
1answer
39 views

A feasible approach for AEAD on an ethernet link?

The setup is shortly this: There are two custom switches (think of an FPGA for example), both are handling 10-100 Gb/s orders of traffic from their outside facing interfaces. This is normal traffic. ...
3
votes
1answer
93 views

Reasonable Password Entropy given a certain Set of argon2 Parameters

I followed the recommendation of choosing threads, memory consumption and the number of iterations (in that order) on my machine. But now I wonder which passwords (by means of entropy) are actually ...
7
votes
2answers
643 views

Why do some key derivation functions (like PBKDF2) use a salt?

Let me start by explaining my understanding of the various concepts involved in this question: Salt: Random bytes of data used as secondary input for a password hashing function, like so: ...
5
votes
1answer
95 views

Login security and plaintext of a password stored in Argon2i to derive a key via halite safe?

I'm using Symfony 4. I have set parameters on all my Argon2 stuff below so that it takes 1s per iteration. This website is supposed to encrypt HIPAA information. Basically I have a table like this <...
0
votes
0answers
47 views

How secure are key-derived S-boxes?

I have seen some papers which show that random s-boxes aren't secure. But I have never seen anything on key-derived s-boxes. How does one even begin to attack a cipher for which the non-linearity is ...
1
vote
0answers
17 views

Use derived keying material as key for stream cipher

Section 7.3 of SP 800-108: To comply with this Recommendation, the derived keying material shall not be used as a key stream for a stream cipher. Footnote: The level of security provided by ...
1
vote
1answer
62 views

Why use a date-dependent substring of a pre-shared key instead of just the key?

I've recently come across a situation where one system passes an encrypted payload to another system. The payload is encrypted using a pre-shared key. However, instead of just using the key itself, a ...
3
votes
1answer
83 views

Key derivation: Does it make sense to use KDF and PRF consecutively?

I'm in a project, where the output of a Key Agreement algorithm (uses ECC) is used as input for a KDF, and the output of the KDF (X9.63 KDF) is consecutively used as input for a PRF (CMAC) to ...
0
votes
0answers
39 views

How computationally heavy these algorithms?

I want to use Signal protocol to encrypt sensors data. As we know sensors have limited memory, CPU power, and battery. And Signal protocol has the following processes: Encryption: AES in CBC mode and ...
0
votes
0answers
20 views

Generate new future keys from used

I have implemented DUKPT according : Questions about future and session key generation in DUKPT process And by using this project: https://github.com/sla-000/dukpt-c At now I get IPEK and generate 21 ...
1
vote
0answers
33 views

Is there hierarchical key generation that completely tolerates leakage?

Is there a hierarchical key construction algorithm that achieves forward/backward privacy with any (unlimited) leakage of private non-master keys? What I mean is that if there's an unbounded number ...
2
votes
2answers
58 views

How is formal analysis of the strength of a round achieved?

I've been trying to understand how the number of rounds are picked for ciphers. There seems to be a minimum number of rounds that is analyzed for "strength" and then some security margin is added. ...
0
votes
0answers
21 views

What pairing does Charm Library use, like Tate or Ate or something else?

I'm implementing a pairing-based key-agreement scheme using Charm Crypto and PBC, and I'm struggling to understand the relationship between the curves proposed for use with pairings and the pairings ...
0
votes
1answer
59 views

How do i generate the shared key from this question?

Say I have Alice and Bob: Alice has $XA$, $YA = g^{XA} \bmod P$, $RA$ (random number) Bob has $XB$, $YB = g^{XB} \bmod P$, $RB$ (random number) Assume they have exchanged their certificates and ...
1
vote
1answer
86 views

Doubts regarding implementing AES128 bit algorithm in my IOT system

I want to implement AES128 in my IOT network which consists of a Master device which runs Linux on it and slave devices which are 8-bit microcontrollers that periodically transmit data packets to the ...
2
votes
0answers
35 views

Key update and re-keying

What is the exact difference between the key update and re-keying? Following the discussions here, I understood that the key update is the process of deriving the new session key from old key. In the ...
1
vote
2answers
105 views

In RSA, is it possible to compute the private key if one knows one of the primes used to generate n?

Within RSA the private key can be derived if one knows both $p$ and $q$. Is it possible to derive the RSA private key or decrypt / learn something about encrypted messages if you only know one of the ...
2
votes
1answer
43 views

Revoke a GPG key using previously generated revoke certificate after renewd (change expiration date)

I have few sub-questions Do secret keys get expired, or just the public key gets expired? Do I have to back up the master sec key each time I renew it? For an ...
0
votes
1answer
76 views

Good practices for AES key derivation and management

I'm developping a device based on STM32L4x6. It is connected through BLE to a smartphone and it exchanges encrypted data with it. Data consists of health data of patients. Encryption is AES-GCM 256 ...
1
vote
0answers
48 views

Securing MQTT communication

I am building kinda simple IoT project, but I would like to implement good security (just for educational purposes and fun). My plan is to build simple solution where one arduino board reads some data ...
0
votes
1answer
54 views

correct a corrupted shared key

Suppose we have an almost shared secret. For example if we have a noisy connection to a shared secret source of randomness. So Alice has $k_1$ and Bob has $k_2$ similar but not necessarily identical ...
3
votes
1answer
233 views

Turn a password into a key without using salt

Assume I have a password with sufficient entropy but may not be uniformly distributed, how can I turn the password into a key that can be used for symmetric encryption? I think there is surely such a ...
2
votes
3answers
114 views

Generate 2 independent keys from a master key

The scenario is like this: I need 2 keys for different purposes (encryption + encryption, encryption + mac, or whatever). Because it is not good practice to reuse the same key, I'd like the 2 keys to ...
2
votes
0answers
232 views

Curve25519 / Ed25519 - Generate a private key from this term

I have 2 key pairs $(x_1, y_1)$, $(x_2, y_2)$. I also have $a = $random 256-bit array and $b = $256-bit of defined values from me. I know the values for $(x_1, y_1)$, $x_2$ and $b$. But I miss the ...
2
votes
2answers
81 views

Why is it recommended to hash passwords with a secret salt?

NIST recommends doing an additional round of hashing using a secret salt: In addition, verifiers SHOULD perform an additional iteration of a key derivation function using a salt value that is ...
1
vote
1answer
20 views

Why the output length of a KDF should be the same as the underlying OWF?

Quote: The chosen output length of the key derivation function SHOULD be the same as the length of the underlying one-way function output. Could someone please help explain the benefits and ...
2
votes
0answers
53 views

Sharing salt for deterministic symmetric key derivation

I have a requirement to generate and share unique symmetric keys for a large numbers of small data objects. In many cases the storage and retrieval of the key for each object will be a significant ...
3
votes
2answers
64 views

Are PBKDF2 derived keys related if only the number of iterations is changed?

I'd like to encrypt my disk with a password. To generate a nice key from a password, I used PBKDF2, which applies a hash function $k$ times to a cleartext and outputs the final result. When I ...
1
vote
2answers
145 views

Relationship between PRF/KDF/MAC?

It seems that not every MAC is a KDF. But would any PRF also work as both KDF and MAC? Could someone explain the relationship between these 3 definitions?
1
vote
0answers
30 views

Question on inputs of PRFs and HKDF KDF

I've read a lot of information about PRNGs, PRFs and KDFs. As far as I know: PRNG: The seed for the PRNG must be a uniform string. It transforms a short real uniform string into some bits of pseudo-...
3
votes
1answer
65 views

Block cipher birthday bound and a KDF workaround

Can the birthday bound arising from a block cipher’s block size be worked around by deriving different keys from the master key with a KBKDF using a tweak? For example consider the following scheme, ...
1
vote
1answer
179 views

HMAC SHA256 for deriving session keys using random nonce

I need to derive session key in order to create an application layer secure channel between mobile app and a bluetooth device. My scheme is similar to this scheme that uses a HMAC and counter. ...
1
vote
1answer
63 views

derive child keys from a private key

My problem is the following: I have an organization with many members. When someone from the outside communicates with this organization, I want any member to be able to decrypt the communication. ...
3
votes
1answer
207 views

Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?

PBKDF2 should only be used to generate a larger output than the hash function it uses if the output is used in such a way that it has a flat keyspace. As far as I am aware, XTS does not have a flat ...
2
votes
1answer
51 views

Reveal all information up to n-th message

Is there a way to generate a sequence of keys that have the property that exposing any of those keys will reveal all previous keys, but no future key? I'm thinking about an application that sends an ...
0
votes
2answers
153 views

Multiple key generator

I need an algorithm for "key generator". It should be initialized with some secret data, such as a (hashed) passphrase, or something generated once by some 3rd-party code. Given some small input it ...
1
vote
1answer
29 views

Encryption program conseil

I'm writing a little program to encrypt and decrypt a file. I'm using AES encryption in CTR mode that takes a key generated by a KDF (script). I have read some articles about cryptography but I have ...
1
vote
0answers
24 views

Time-sensitive key derivation for sharing with third-party

Devices: In this system, users have one or more wearable devices (a smart watch), one of which they will most likely have on their person all the time. The devices are linked to their account by their ...
3
votes
1answer
87 views

Combining multiple cryptographic keys to generate an encryption key

We have a system that has several SecretKeys (for example, one for a user, and one for us). We want to encrypt data in a way that requires all of those keys to be available in order to decrypt. I ...
3
votes
2answers
121 views

Using HKDF to derive symmetric keys from a hybrid public-key encryption scheme

RFC 5869 describes HMAC-based Extract-and-Expand Key Derivation Function (HKDF). In section 4, entitled "Applications of HKDF", it states that one of the intended uses is: derivation of symmetric ...
0
votes
1answer
51 views

is it safe to leak some information about scrypt result?

I am encrypting a file via AES-CBC and am using scrypt to extract a key from a user-provided password. The IV is public and is stored with the encrypted file. Is it safe to generate my IV (public) ...
-4
votes
1answer
83 views

How to reversely compute from hash [closed]

What are practical methodologies to derive the following ciphertext: 1bd0d370b262d748b21c40cc7e5746642b4c06079a224c65e443e429289753c2
2
votes
0answers
79 views

Can proofs be relayed to derived keys?

I am aiming to find out if this problem/puzzle can be solved with cryptography at all. Say there are these two parties: Subject S which has a master private/public key pair (MPriv, MPub) and a set of ...