Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
0
votes
0answers
23 views

User key management scheme: BYOK vs. client only keys vs. a mix of both

We are designing a web app where users can share documents with each other. The ultimate goal is to achieve zero trust needed by the users, i.e. client-side encryption makes sure that the servers (or ...
7
votes
2answers
1k views

Do I need to sanitize user input to scrypt, or to PBKDF's in general?

I'd like to allow the user to supply a password as input to some PBKDF, which I will use to construct a key for file encryption (currently using aes-256-ctr. It may change as I learn more). I am ...
21
votes
2answers
13k views

What is the difference between Scrypt and PBKDF2?

After reading these two resources I am wondering am I getting all the differences between Scrypt and PBKDF2. As far as I understood, the similarity is: both are password-based key derivation ...
1
vote
0answers
34 views

Combining Post-Quantum and Classical KEM

I came across this paper "Hybrid Key Encapsulation Mechanisms", were three methods are defined that allow a secure combination of a classical key encapsulation with a post-quantum key ...
0
votes
1answer
169 views

AES Password Based Key Derivation Iterations

I have been writing my own implementation of the Advanced Encryption Standard with cipher block chaining in python3 for the last several months, mimicking the OpenSSL command line interface. I can ...
0
votes
1answer
57 views

AWS signature v4 key derivation

Generating Authorization header with AWS signature v4 involves deriving signing key as follows: https://docs.aws.amazon.com/general/latest/gr/signature-v4-examples.html ...
2
votes
3answers
443 views

Efficient way to pick an array index by using a, say, 64 bit random number?

Say, I have uint64_t rand = <some random number>, and char array[20] = .... My goal is to pick an element in ...
0
votes
0answers
46 views

Saving highly sensitive data in US cloud - what encryption would you use?

We have a cloud-based application running on AWS servers and are looking for a way to store highly sensitive user data there without giving AWS the possibility of exposing our data to the US ...
1
vote
1answer
43 views

HKDF with predefined IV

Can I generate from a randomly generated key let say three other keys via HKDF with predefined IVs, eg. Sha-256 of "apple", "banana", "pear"? My use-case is an app that ...
1
vote
1answer
536 views

How to choose parameters for Argon2 for a password vault

I'm creating a password vault, and I plan to use Argon2id to derive the master key from the master password. For encryption, I plan to use XChaCha20 with Poly1305. To be clear: a set of multiple ...
5
votes
0answers
124 views

Upgrading key derivation by adding an XOR with a known value

In general, keys for password-based key derivation are derived from a password hash such as the old PBKDF2 function or Argon2, possibly followed by another derivation function to derive data and ...
5
votes
2answers
709 views

Memory-hard password-based key derivation functions?

How are memory hard functions designed for the purpose of password based key derivation? To protect against a brute force attack from a parallel machine. What design could work well with Skein? The ...
0
votes
0answers
36 views

Managing master keys used in PBKDF2 and HMAC (store, rotate)

My use case: I have few master keys, I use each for a specific operation (e.g. one for encrypting user's data and another for creating JWT signatures etc...). I use these master keys in two specific ...
14
votes
2answers
9k views

Deterministically generate a RSA public/private key pair from a passphrase (with sufficient entropy)?

Is it possible to deterministically generate public/private RSA key pairs from passphrases? Would giving the (key generating) algorithm data made from key-stretching the passphrase (instead of a ...
2
votes
1answer
41 views

Can the AES-GCM authentication tag be used as a key derivation function?

I want to build a deterministic key derivation tree, where the root is stored securely in a centralized service and the leaves are embedded in a multitude of devices. When a device wants to ...
1
vote
0answers
18 views

Can the hash of a PKCS1 v1.5 RSA signature be used as a key derivation function?

I know this sounds crazy, but hear me out. As a follow-up to Can the AES-GCM authentication tag be used as a key derivation function?, I'm also considering more creative solutions to derive unique (...
3
votes
1answer
192 views

How is a group element converted into a key?

I've only just started research on cryptography so I apologize if this is a basic question or I'm getting terms confused. I'm researching braid group cryptography and currently looking at the Anshel-...
3
votes
2answers
437 views

Revoke a GPG key using previously generated revoke certificate after renewd (change expiration date)

I have few sub-questions Do secret keys get expired, or just the public key gets expired? Do I have to back up the master sec key each time I renew it? For an ...
1
vote
1answer
188 views

CTR overlap with random IV

Problem: I'm slightly worried about counter repeats in CTR mode when using random IV. If you split it (like half IV, half counter), it increases chances of same IV (it is smaller) and limits message ...
-2
votes
1answer
36 views

Encrypted file sharing with deterministically generated key from user password

Background info: I need to encrypt files in a enterprise workspace with several users. The goal is to encrypt files directly from browser to be saved on a server and each user could decrypt files for ...
10
votes
4answers
11k views

Looking at hash output – is Base64 encoding in any way better than HEX encoding?

I was wondering why most "normal/unsafe" crypto hashes like SHA-256, SHA-512, Whirlpool, RipeMD-160, MD5, etc. are HEX encoded. But most "secure" crypto hashes (KDF' ) like ...
3
votes
1answer
68 views

Is PRF XORed with its key still a PRF? (always)

$\forall k \in \{0,1\}^n,m \in \mathbb{M},F_k(m)$ is defined as follows: $F_k(m) = F'_k(m) \oplus k$. It is known that $F'_k$ is a PRF. Note: 𝕄 is the message space and it's assumed that the key $k$ ...
1
vote
1answer
194 views

Best practise for encryption in a password manager

I'm trying to make a password manager for Windows installed computers, and after researching the best ways to encrypt the passwords in the database (I'm new to cryptography) I think I've come up with ...
1
vote
2answers
61 views

is it safe to combine scrypt with other hash algorithms?

I'm currently writing a file encryption program, and I designed this scheme to derive a key from user input password: ...
0
votes
0answers
39 views

Why do you need to apply hash over DH shared key? [duplicate]

I`ve read multiple times that it is not safe to use the shared key resulted from DH key exchange directly and that you need to do a KDF or hash over it and then use the result as a key. Why is it not ...
0
votes
0answers
49 views

Adding salt to Blake3 Key derive function

According to the whitepaper, Blake3 can be used as a key derivation function (function key_derive). Currently, as a key ...
2
votes
1answer
4k views

What is the use of key iterations?

I read about PBKDF2 on Wikipedia and seen few apps. having option to manually enter number of iterations. I am still not clear on this. (1) With what I understood, key iterations can be used only ...
1
vote
1answer
64 views

Am I using these key derivation functions correctly?

I am a bit confused about key derivation functions. I am trying to use the argon2 KDF from the passlib python module to do the ...
2
votes
1answer
154 views

Apply HKDF after Diffie-Hellman Key Exchange

I'm trying to use HKDF after Diffie-Hellman key exchange. However, I got stuck on the HKDF part. ...
13
votes
3answers
1k views

Is it better to maximize memory usage or number of passes with Argon2i 1.3?

I wrote a small application that uses Argon2i for deriving symmetric keys for encryption of local files and secret Curve25519 keys. Argon2i v1.3 is susceptible to TMTO attacks if the number of passes ...
46
votes
1answer
34k views

Password hashing security of argon2 versus bcrypt/PBKDF2?

I wonder if it can be approximated how much of a security margin the new argon2 hash, winner of the password hashing competition, can give over bcrypt or PBKDF2, for an attacker using large GPU ...
1
vote
1answer
753 views

Key Derivation Function (KDF) usage for password storage

Is it safe to use a KDF implementation in order to store passwords? More broadly, is this standard? Do IT-companies really use KDF? Or do they usually rely on other algorithms? If you have any ...
3
votes
2answers
137 views

How many different keys can be derived with HKDF before two outputs are identical?

How many different keys can be derived with HKDF before two outputs are identical? This question is about collision resistance, not about generating different keys with different parameters (eg. ...
0
votes
2answers
132 views

KDF and salt storage

Regardless of the KDF I will use, let's imagine that I have to generate two keys: one for authentication and the other for encryption (which will always remain on the device that generates it until ...
6
votes
1answer
2k views

Multiple AES Key Derivation from a master key

I need cryptography advice regarding this issue. Kamus is a service that encrypts secrets for applications running on Kubernetes. When using AES (actually, Rijndael) symmetric encryption, Kamus uses ...
1
vote
1answer
971 views

Differences between HMAC and HKDF in a specific case

I want to use a key derivation function to derive a key from another one. I think HKDF is the easiest solution in my case. This explanation gives a clear definition of HKDF. In the case where the ...
0
votes
0answers
26 views

Randomizing output of HKDF for the same input key material [duplicate]

Given HKDF and a master input material key $k$, I would like to derive ephemeral keys that cannot be linked together. If I understand correctly, the specification of $HKDF$ adding a unique random $...
2
votes
1answer
333 views

Is tagging the hash of a password along with ciphertext secure?

Suppose I have a password, in which I use Argon2ID with 1GB memory to derive an encryption key. Then, I encrypt my data using XChaCha20 using that encryption key. The problem with ChaCha is that any ...
9
votes
0answers
1k views

Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information on its advantages against CBC ...
7
votes
2answers
1k views

Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?

I have a following use case: User has his master public (pk) - private (sk) key pair (Ed25519). In DB we store a public key. Is ...
0
votes
0answers
37 views

How does order in KDF formula affect its security proof?

If the expansion phase of key derivation is captured by the abstract formula (per Krawczyk): KM = PRF* (PRK, CTX, L) Then what happens to the security proofs if someone were to swap PRK and CTX. For ...
6
votes
2answers
3k views

Derive a secret from an RSA private key

What I want to do is deterministically derive a secure key from an RSA private key, such that the RSA private key cannot be derived from the secure key. The first approach that came to mind was ...
2
votes
2answers
184 views

Optimal memory-hard KDF parameters when faced with small, slow memory

I am developing for a low-power embedded system. It has two ARM9 processors at 48 MHz each. One of the processors has access to 6 MiB of "fast" memory as well as access to 26 MiB of "...
0
votes
0answers
43 views

Best way to derive a MAC key without a salt

It's best to use separate keys for encryption and the MAC. Most implementations tend to derive a larger key and split it in two (e.g. scrypt with an output of 32 + 64 = 96). Alternatively, you can ...
8
votes
1answer
2k views

Is the AES Key Schedule weak?

After reading this paper entitled Key Recovery Attacks of Practical Complexity on AES Variants With Up To 10 Rounds, I was left wondering why AES's key schedule is invertible. In the paper, the ...
0
votes
0answers
56 views

Deterministic generation of secure private keys from parent private key

is it possible to generate set of child private keys from one parent private key, generated by ECC for example, securely? So that new private key (and derive public key) could be used for encryption ...
0
votes
1answer
85 views

Deterministic Key using a seed for ECNamedCurve

I am trying to generate deterministic keys using EC curve secp521r1 in java. I went through KDF but, couldn't find any references to use it with EC curves. I would appreciate if someone could point me ...
0
votes
1answer
35 views

Use of the info parameter in Hybrid Public Key Encryption

I dont understand the use of the info parameter, what does "to fold in identity information" mean? What is the security benefit? All the algorithms also take an info parameter that can be ...
2
votes
3answers
7k views

Key derivation using the main AES encryption key and some plain text?

I am using AES 128 bit encryption in java. I have an encryption key and 10 digit plain text. I want to derive a key for HMAC using the AES encryption key and the 10 digit plain text. This plain text ...
2
votes
1answer
173 views

How to estimate the maximum computational cost bound for Key Derivation Functions (KDFs) before it becomes useless security-wise?

From my understanding of Key Derivation Functions (KDFs), e.g. scrypt, Argon2, etc, we can tune their parameters such that it eventually becomes harder for an attacker to brute force a password-to-key ...

1
2 3 4 5
11