Questions tagged [key-derivation]
In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.
641
questions
0
votes
2
answers
88
views
Derive Multiple Keys from password
I am currently building a platform for storing documents for my private use. The goal is to upload only encrypted files.
Therefore i want to use the user password for authentication and also for ...
0
votes
0
answers
32
views
Finding wifi encryption key in memory
I wanted to know whether the encryption keys derived for data encryption are stored in RAM or not after establishing a Wi-Fi connection in WPA2 and WPA3 protocols. If the answer is yes, can these keys ...
0
votes
1
answer
128
views
Is there an open source key-derivation service?
Hello sorry if this is a silly question and do say if this would be more suitable for a software stack-exchange but after a lot of googling I've still not found anything suitable, so starting to worry ...
CommunityBot
- 1
3
votes
1
answer
200
views
Why does using keyed-$PRF$-derived inputs in a (non-committing) $\texttt{nc-AEAD}$ not provide commitment?
A definition for committing security in authenticated encryption can be described in relation to a security parameter $\lambda_{com}$, where the per-guess probability of finding distinct input tuples
$...
- 1,116
5
votes
0
answers
158
views
"One use, one key" rule
Sometime in the late 1980's I was introduced to the "One use, one key" rule ("une clé par usage"). A longer version could be: a cryptographic key should have a single purpose, with ...
- 144k
24
votes
1
answer
1k
views
Memory-hard password hash in practice?
Dan Boneh, Henry Corrigan-Gibbs, and Stuart Schechter have proposed Balloon Hashing: A Memory-Hard Function Providing Provable Protection Against Sequential Attacks (in proceedings of AsiaCrypt 2016). ...
- 2,060
3
votes
1
answer
2k
views
Is SHA-256 OK to use for key derivation for a key that is never persisted?
The scenario: On the one side a user enters a pass phrase to encrypt a stream of data (AES-GCM) and a symmetric encryption key is derived from the pass phrase using plain SHA-256 (so not a slow ...
- 53
5
votes
1
answer
214
views
Robust CMAC-based key derivation function
I need to select a function that will be used as a key derivation function (KDF) and pseudorandom function (PRF) in contexts that I haven't anticipated. It will run on very low-end devices (think ...
1
vote
1
answer
66
views
Does a hierarchical key derivation exist? where child keys can decrypt values encrypted by descendants but not vice versa?
I'm trying to entertain a topic, I tried looking around, but I would like a a pointer or someone telling me simply "this cannot work".
I know that usual decryption by private key (whatever ...
- 31
2
votes
1
answer
125
views
Why does Argon2 truncate BLAKE2b outputs?
The Argon2 variable-length hash function uses BLAKE2b directly if the user requests an output less than or equal to 64 bytes in length. However, if the user requests an output longer than this, each ...
- 2,060
2
votes
1
answer
103
views
Does the actual length of a password or salt provide any additional entropy to that contained within them?
I refer to the following wiki description of the Argon2 key derivation function:-
...
- 144k
3
votes
1
answer
137
views
Is using KDF more insecure that generating key directly? (AES 256 CBC)
I am writing a PHP application that requires files to encrypted using AES-256-CBC.
I have two options:
Option #1
Generate a totally random AES key => User Key
Generate another totally random AES ...
- 93.9k
0
votes
1
answer
995
views
AES Password Based Key Derivation Iterations
I have been writing my own implementation of the Advanced Encryption Standard with cipher block chaining in python3 for the last several months, mimicking the OpenSSL command line interface. I can ...
CommunityBot
- 1
0
votes
0
answers
86
views
Key recovery attack on BIP32-Ed25519
BIP32 describes a method for deriving secp256k1 key-pairs. BIP32-Ed25519 is a similar method for Ed25519. For both, the derivations proceed from a root key-pair by adding a random-like integer to the ...
1
vote
0
answers
165
views
Curve448 ECC parameters for use with OpenSSL
I need to be able to deterministically generate (and re-generate) private-public ECC key pairs curve448 for ECDH from human-friendly passphrases (not necessarily human-memorable, just easy to type in),...
7
votes
1
answer
2k
views
Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?
PBKDF2 should only be used to generate a larger output than the hash function it uses if the output is used in such a way that it has a flat keyspace. As far as I am aware, XTS does not have a flat ...
CommunityBot
- 1
0
votes
1
answer
123
views
Deriving the RSA private key [duplicate]
Is there any way to derive the RSA private key from another RSA private key?
Let's say I have a base RSA key $(P, Q)$ (both prime), and then use some salt and an algorithm that creates a new primes, e....
- 150k
24
votes
6
answers
49k
views
PBKDF2 and salt
I want to ask some questions about the PBKDF2 function and generally about the password-based derivation functions.
Actually we use the derivation function together with the salt to provide ...
- 31
1
vote
0
answers
69
views
How to correctly use .NET's HKDF key derivation APIs to generate two keys for AES-256-CBC HMAC-SHA256 encryption
I have a 32-byte cryptographic key generated using .NET's cryptographic random number generator, and I'd like to use it as the key material to generate two other keys per user in my web application.
...
- 111
4
votes
1
answer
155
views
Does the length extension attack apply to KDFs?
Older hash functions like SHA-256 and SHA-512 are vulnerable to the length extension attack, which is problematic in the context of a MAC. There are several ways to prevent this:
Use a newer hash ...
- 3,403
2
votes
1
answer
200
views
Loop back or cyclic nature of secp256k1 curve
I am working with point addition and scalar multiplication on the secp256k1 curve for points $(x,y)$ or public keys to derive the next public key scalar k times further from it. Actually when I use a ...
- 49.3k
1
vote
1
answer
68
views
Using parts of the master seed as the salt for HKDF
Does using a portion of a master seed, such as the last 12 bytes of a 128-byte random master seed, as a salt provide any additional security to the HKDF when deriving child seeds? Alternatively, is it ...
- 93.9k
1
vote
2
answers
227
views
SHA-512 for ECDH key derivation
I'm currently working in a constrained environment and need to derive a symmetric key (that will be used for AES-256 in GCM mode later) based on a low-entropy shared secret obtained via X25519.
To ...
- 49.3k
3
votes
2
answers
582
views
RSA perfect square phi
So I've been learning about RSA for quite a while (mainly by playing around in CTF competitions) and I came across an interesting problem.
The other day I was looking to create a challenge in which I ...
- 144k
1
vote
2
answers
212
views
What scheme is the best for combining two shared secrets?
I'm developing a program that uses a hybrid Key Encapsulation Mechanism (KEM) scheme, employing Kyber and X25519, with each producing a 32-byte shared secret. What would be the best scheme to combine ...
- 3,403
0
votes
0
answers
112
views
Is it safe to derive a secret from a signature?
Many blockchain users have wallets that hold a private key, which can interact with a website. For example, the website can request the wallet to sign a specific message.
'Do only sign this message if ...
- 93.9k
0
votes
0
answers
46
views
Entropy output from 256-bit Argon2 input [duplicate]
I would like to deterministically derive two different 256-bit keys from a single passphrase -- one used as an ECDSA private key, the other as a symmetric key for AES-GCM.
Would a KDF output ...
- 93.9k
1
vote
1
answer
605
views
Key exchange for encrypted firmware update
I'm trying to implement encrypted firmware update functionality for an embedded device. The goal is to prevent reverse engineering of our firmware when the update files are shared with our customers.
...
- 33
4
votes
2
answers
280
views
How can a hash function be suitable for hashing passwords, but not for deriving encryption keys, and vice versa?
Not being a specialist in this field, I am nevertheless constantly trying to keep up with which methods are being considered secure for storing passwords and for encrypting data.
During my research ...
- 143
1
vote
1
answer
166
views
Use of HKDF to get shorter key than digest size
Is OK to derive a key using HKDF (Extract & expand) with a shorter size than the digest size of the configured hash function? In that case the result is computed (on the expand part) by truncating ...
- 49.3k
2
votes
0
answers
129
views
Why KeePassXC is deriving (stretching) the key again before saving changes to the database?
KeePassXC supports Argon2, which is great for security. However, there's a quirk that's been bothering me. Every time I save modifications to the database, it seems to stretch (derive) the key again, ...
- 121
1
vote
0
answers
26
views
Scheme to derive an encryption key from one's verification key, so they can reduce the decryption key from it and their signing key? [duplicate]
There is DH key exchange, but it requires an exchange before participants get to the shared secret. If Bob has only published a verifying key VB, is there a scheme where the following can be achieved?
...
- 11
5
votes
1
answer
1k
views
Is it true that 7zip doesn't use any salt with its KDF?
This issue claims that 7zip does not use any salt with its key derivation function: https://github.com/magnumripper/JohnTheRipper/issues/1679
If that's true, wouldn't that mean you can crack multiple ...
- 144k
6
votes
1
answer
386
views
Cache-hard or memory-hard password hashing algorithms?
bscrypt is a cache-hard password hashing algorithm/KDF from Steve Thomas (aka Sc00bz/TobTu), who was on the Password Hashing Competition (PHC) panel. He argues it is better than the alternative ...
1
vote
0
answers
88
views
Two-party randomness for KEM
As indicated in an earlier Q / A, KEM's do not necessarily directly encrypt a pre-generated random value. However, it is clear that some KEM's do actually do this, with RSA-KEM being an obvious ...
- 93.9k
1
vote
2
answers
530
views
Why does ECIES use "Key Encapsulation"? Does it?
In yet another twist that is the terminology around key establishment I found out that ECIES is often denoted as key encapsulation followed by data encapsulation. I'm wondering how the term "key ...
- 66
5
votes
0
answers
861
views
For TCG-Opal drives, which password is used to derive KEK?
SEDs use a user password (PIN) to generate KEK by a KDF algorithm. The KEK is then used to encrypt the MEK (where MEK is internally generated in the drive). But TCG-Opal drives have 9 locking-ranges ...
- 105
2
votes
2
answers
113
views
How do KDFs work, and what existing implementations exist?
TLDR/End goal
I want to encrypt a tree of data/files so that anyone with the master key K can decrypt everything, key K-1 can ...
- 101
5
votes
2
answers
5k
views
How to specify a NIST SP 800-108 KBKDF
Strange question maybe, but say I want to specify a protocol that complies with NIST SP 800-108. This lists a whole set of key based key derivation functions, with a very loose set of parameters.
How ...
- 301
0
votes
1
answer
115
views
How much of SHA3's internal state can be reached?
After reading that about "37% of the 256-bit outputs" of SHA-256 are unreachable when fed only 256-bit inputs [1] I'm curious & confused. The formula from the proof here considers a ...
- 150k
0
votes
1
answer
85
views
RFC: Approach to CSPRNG
I've been experimenting in python with different approaches to cryptographically secure pseudo random number generators, comparing them using the NIST testsuite implemented by https://github.com/...
0
votes
1
answer
193
views
Is keccak256 (and similar hash functions) a suitable KBKDF for 256-bit keys?
Let's temporarily work upon the assumption that proper KBKDF functions do not exist, for the sake of argument.
Would keccak256 be a secure choice for a KBKDF that derives 256-bit keys from a 256-bit ...
- 3,516
1
vote
0
answers
62
views
Linux Kernel CryptoAPI key exchange and key derivation
I have a custom network and I want to implement a symmetric key exchange and key derivation mechanism with ECDH.
I know that I need to use KPP API and ECDH helper functions, but I can't find any code ...
- 9,672
0
votes
1
answer
271
views
Clarification on the use of Key block Version ID with Thales HSM
Clarification on the use of Key block Version ID
For the first time since we migrated to the Key Block we are exchanging keys with third parties,
The keys were all generated by choosing Key Scheme &...
- 36
2
votes
2
answers
954
views
security of using digital signature as key derivation material
I want all keys in my iOS application to rely on the Secure Enclave for security as the iOS keychain becomes insecure on jailbroken devices. Currently, the Secure Enclave currently only supports ...
2
votes
0
answers
40
views
ZKP of knowledge of EC keys preimage
There is a random scalar seed $s$ which we may call a master secret.
There are 2 public strings or scalars: $m1, m2$ and 2 corresponding EC keypairs: $a, A=a*G$ and $b, B=b*G$
$a$ and $b$ are somehow ...
- 149
2
votes
1
answer
144
views
Deterministic EC key derivation with anonymity and proofs
Following up this question
There are 4 parties:
Alice, who needs to prove a posession of some statement $m$, unique to her, say a street address, which is basically a string of some predefined format,...
- 4,760
3
votes
1
answer
60
views
It is correct to concatenate HKDF expand stages?
I want to derive session keys for many clients from a Master Key. Suppose I derive a key for the client $n$ in the following way:
master_key = HKDF-extract(salt, IKM)
key_client_n = HKDF-expand(...
- 93.9k
4
votes
2
answers
903
views
Bluetooth Low Energy: Key generation
I'm studying the BT core spec v5.1 to understand the security features and how everything fits together. I am looking at Secure Connections for now.
In the field "Key generation" it says it uses P-...
- 183
2
votes
1
answer
182
views
Manually deriving asymmetric key pairs with Openssl
In Openssl, is there a way to systematically generate a private key such that every time you perform this key derivation, you produce the same private key?
It seems like every openssl command that ...
- 463