Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
1
vote
1answer
40 views

How to choose parameters for Argon2 for password vault

I'm creating a password vault and I'm planning on using Argon2id to derive the master key from the master password. For encryption I'm planning on using XChaCha20 with Poly1305. To be clear: a set of ...
0
votes
1answer
24 views

Using platform-level RNGs for key derivation with hash functions like BLAKE3?

So I've read stack overflow questions like this one. What I'm wondering is a bit more specific though: I'm really liking what I'm seeing with BLAKE3. (I suspect that this hash function is relatively ...
0
votes
1answer
26 views

Why is SKEYSEED derived using the nonce as a key?

In IKEv2, SKEYSEED, which is used to as a seed for generating the rest of the keys, is generated as SKEYSEED = prf(Ni | Nr, g^ir)...
0
votes
1answer
36 views

Is it possible to derive a constant value from different signatures of a private key?

For example perhaps deriving the same PRF from RSA signatures on different messages from a (not known) private key? Struggling to find the proof of why not.
2
votes
0answers
39 views

Security problems if ECDH and ECDSA use the same key [duplicate]

Hy! I want to use an EC key for ECDH and ECDSA too. Using the same key does compromise the security of the key in a cryptographic / mathematical sense? I read a lot in this theme, but I found nothing ...
0
votes
1answer
48 views

Can I use the same key pair for authentication and Diffie-Hellman? [duplicate]

Assume Alice has a key pair $(A, a)$ and Bob has a key pair $(B, b)$, where $A = Ga$ and $B = Gb$. In general, the basic rule of crypto says that we should not use the same key for different ...
1
vote
1answer
43 views

Can I compress $192$ byte key into $16$ or $32$ bytes which can be later used in KDF to recover full key

I have a key $k$ which is $192$ bytes long. Is there a secure way to first compress this key into $16$ or $32$ bytes, but in such a way that later given those $16$ ($32$) bytes I can use a key ...
5
votes
3answers
890 views

Asymmetric key derivation – Who derives the new pub key can't know the new private key?

I'm looking for a peer reviewed protocol or algorithm that can do this, preferentially I need something based on elliptic-curves cryptography. Alice know the main public key of Bob (B-PUB-1). Alice ...
2
votes
0answers
64 views

For TCG-Opal drives, which password is used to derive KEK?

SEDs use a user password (PIN) to generate KEK by a KDF algorithm. The KEK is then used to encrypt the MEK (where MEK is internally generated in the drive). But TCG-Opal drives have 9 locking-ranges ...
0
votes
1answer
336 views

Securely derive AES and ED25519 keys from a ED25519 seed

Go's ed25519 package exposes a function which allows creating a private key from a 32 byte seed. See: https://godoc.org/golang.org/x/crypto/ed25519#NewKeyFromSeed The reason I want to use this is ...
3
votes
1answer
77 views

Good key update algorithms for key evolving schemes

In schemes like SAKE(Symmetric-key Authenticated Key Exchange) , the master keys (used to authenticate parties and generate session keys) are evolving, ie undergo transition $K=update(K)$. What is a ...
0
votes
0answers
41 views

is it safe to do public key to public key derivation with Ed25519?

Deriving a public key from a public key in Ed25519 is possible, some algorithms are available. My question is why there are so few implementations compared to secp256k1 for example. The extra checks ...
6
votes
2answers
223 views

Using XOR to derive a data key for ECIES

I have been thinking about a rather simple enhancement for (EC)IES / RSA-KEM. The scheme would allow you to encrypt data while the calculation of the session / data key can be performed afterwards or ...
2
votes
1answer
60 views

Generate AES key from weak string

I'm trying to generate AES256 key from user input password. The size of the password can be anything from 4 bytes long to 32 bytes long but let's assume it is the smaller one. My API support either : ...
0
votes
0answers
34 views

Any gotchas when deriving a symmetric key from two seeds?

Consider a connection protocol where, after jumping through several other hoops, Alice and Bob know each others' public keys; and they now want to do a RSA-handshake-kind-of-thing to come up with a ...
2
votes
1answer
33 views

What are the randomness requirements for inputs to PBKDF2?

I need to generate one 160-bit HMAC-SHA1 key for each user in my system. Can I use the username as the input to PBKDF2 function to generate the key? Is it safe to use known values like username as ...
0
votes
1answer
77 views

KDF for generating RSA and ECC keys from a 2048 bit secret

Do KDFs exist for generating RSA and ECC keys from a 2048-bit random secret?
2
votes
1answer
307 views

Revoke a GPG key using previously generated revoke certificate after renewd (change expiration date)

I have few sub-questions Do secret keys get expired, or just the public key gets expired? Do I have to back up the master sec key each time I renew it? For an ...
1
vote
0answers
24 views

How to handle IKEv1 and IKEv2 diffie-hellman shared secret bits length not multiple of 8?

In Cryptographic Algorithm Validation Program for KDF document, here, page 9, it says "If a field size that is not a multiple of 8 bits, the shared secret is represented by a string of bytes that ...
0
votes
0answers
44 views

How to Derive a Child RSA Key Pair from an Existing RSA Key Pair?

I want to understand how, using standard tools like openssl (or similar), to derive a child RSA key pair from an existing RSA key pair. Additionally I would like the derived key to contain a ...
1
vote
1answer
47 views

Secure password reset

In my model I use two different keys, one for authentication and the other for the encryption / decryption of the data that the user saves, each derived from the master password with a KDF function. ...
0
votes
0answers
65 views

Are My Answers to This AES Question Correct?

Question I am extremely new to cryptography and AES and so I am not confident that I did this question orrectly. Please can you check my answers and let me know if anything jumps out as incorrect, ...
0
votes
2answers
58 views

KDF and salt storage

Regardless of the KDF I will use, let's imagine that I have to generate two keys, one for authentication and the other for encryption (which will always remain on the device that generates it until ...
16
votes
3answers
9k views

How many KDF rounds for an SSH key?

What is the best practice on choosing how many key derivation function (KDF) rounds/iterations when generating an SSH key pair with ssh-keygen? Am I correct in saying that it is unnecessary if the ...
0
votes
0answers
48 views

KDF options for a ECDH shared secret

the answer to this question suggests that the x-coordinate of an ECDH shared secret is itself usable as an encryption key without apply a KDF.... if so, then what additional security is provided by ...
5
votes
1answer
417 views

Is it necessary to stretch/derive an AES key when I already have enough bytes from a 'cryptographically secure RNG'?

I'm using AES-CBC-256 with PKCS#7 compatible padding. I already have 32 bytes that come from a 'cryptographically secure random number generator'. In this scenario, does it make sense to use PBKDF2 to ...
1
vote
2answers
59 views

Meaning of the term “Key Material”

I am reading specifications from my client that focuses on the topic of security. In these specs, the term key material has appeared many times. I used Google to look for what the term means. ...
2
votes
1answer
442 views

Would it be better to use HKDF or SCrypt for deriving a child key?

Okay so I'm trying to derive a child public key from an EC public key. I've come up with a couple ideas and now I'd like to know which is more secure. Mp: The master key pair, this includes a ...
6
votes
1answer
162 views

Is Argon2id safe from the discovered Argon2i issues?

So far, as I understand it, two ways to reduce the complexity of Argon2i have been found, one of which was fixed in Argon2 1.3, and one of which is still unfixed but is not a practical problem given ...
7
votes
3answers
7k views

Looking at hash output – is Base64 encoding in any way better than HEX encoding?

I was wondering why most "normal/unsafe" crypto hashes like SHA-256, SHA-512, Whirlpool, RipeMD-160, MD5, etc. are HEX encoded. But most "secure" crypto hashes (KDF' ) like ...
0
votes
0answers
60 views

Apply HKDF After DIffie-hellman Key Exchange

Im trying to use HKDF after DIffie-hellman key exchange. However, i got stuck on HKDF part. ...
0
votes
1answer
41 views

How to apply a block cipher to (large) packetized communication when packets can get lost/erased?

In light of current events (Zoom getting strong headwinds for using AES-128 in ECB mode), I was wondering what the general approach is to packetized data encryption, where the packet length (UDP for ...
1
vote
1answer
49 views

Computationally expensive key derivation whose difficulty is asymmetric

I am looking for a primitive or a construction that meets the following requirements. Is such a construction (a) theoretically possible, and (b) in existence right now? Given are: a long secret $X$ ...
2
votes
5answers
164 views

How passwords are fed to key derivation functions?

Suppose I want to encrypt data, send it over the network, and decrypt it on the receiver side. I know the elegant way to do this is by using a symmetric key to encrypt the data and an asymmetric key ...
4
votes
1answer
849 views

Multiple AES Key Derivation from a master key

I need cryptography advice regarding this issue. Kamus is a service that encrypts secrets for applications running on Kubernetes. When using AES (actually, Rijndael) symmetric encryption, Kamus uses ...
1
vote
1answer
49 views

DHE parameters: which parameters need to be random each time?

In DH key exchange, first, both parties need to agree on a generator $g$ and prime $p$. After that each party computes its key (party A: $g^a \bmod p$) and (party B: $g^b \bmod p$), then they exchange ...
1
vote
1answer
158 views

TDES (Triple DES) DUKPT decryption

We have a POS (Ingenico) that uses DES3-CBC encryption using a derived key. It sends encrypted data, and 10 bytes size Key Serial Number (KSN). I tried to use ...
2
votes
1answer
146 views

ChaCha20-Poly1305: Can my salt/pass for a KDF also be the nonce?

I have a PSK. I don't want to use it directly. I want to pass a "salt"/password into a KDF and get a new key for authenticated encryption with ChaCha20-Poly1305 . I need to give the other side the ...
0
votes
0answers
29 views

Using PSK starting a new session, encrypt the new session key with old, or sign a derivative to be used on the old key?

I have two endpoints that go through a middleman. Both have a pre-shared and secure key, 16bytes to be used with ChaCha20-Poly1305. Extremely constrained device. No packet larger than 100 bytes total. ...
2
votes
1answer
225 views

Is using AES-256 with a key of less than 256 bits of entropy still quantum-resistant?

Encrypting with AES-256 is widely claimed to be post-quantum secure. But let's take a case where you use an initial key that has less than 256 bits of real entropy. In this example, let's work with a ...
8
votes
2answers
8k views

What are KDF parameters in OpenSSL command-line utility for `enc`?

I refer to https://www.openssl.org/docs/manmaster/apps/enc.html and see that the only parameter for key derivation which I can set explicitly (not considering the obvious ...
0
votes
0answers
51 views

KDF3 - implementation explanation

An old project that I did not code is using the KDF3 algorithm, but I struggle to find an explanation about the way this key derivation algorithm works. I know that this algorithm is part of the ISO-...
3
votes
4answers
2k views

Could a 2nd EC private key be derived from a public key?

I understand that the public key does not expose the private key. That is not the question. The question is: Given a EC public key, can a different, but plausible and functional private key be ...
0
votes
2answers
136 views

Is it safe to use a deterministic salt as an input to KDF (Argon2)?

I'm prototyping an app that uses client-side password hashing in order to hide the "real" account password from a server (the server hashes any recieved password anyway, so no plaintext records in the ...
6
votes
5answers
1k views

Use a SHA256 as a key for AES256

Is it safe to use the SHA256 of a hard-to-bruteforce string as the key to encrypt data with AES256?
1
vote
1answer
66 views

Derived keys usable by threshold signatures

Suppose there are $n$ members in a $(t,n)$ threshold signature scheme. The global secret key $sk$ is not known to any single party, as the keys are generated distributed. The parties are able to ...
0
votes
0answers
51 views

BIP32 Extended Key to EC Private and Public Key Pair

We are working on an application in Android using Java. In our project, we used to generate EC key pairs (of size 384 bits) using SpongyCastle - an old Android version of Bouncy Castle. The problem ...
1
vote
1answer
108 views

Doubts regarding implementing AES-128 bit algorithm in my IOT system

I want to implement AES-128 in my IoT network which consists of a Master device which runs Linux on it and slave devices which are 8-bit micro-controllers that periodically transmit data packets to ...
0
votes
0answers
16 views

Scrypt cipher - known vulnerabilities and cryptanalysis? [duplicate]

there is a Scrypt cipher which is used for exmaple by some cryptos like LItecoin for their mining algorithm. I never heared of scrypt. I know eg SHA256 which is well analyzed and considered as secure ...

1
2 3 4 5
10