Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

3
votes
1answer
108 views

How will be cipher selected when Client is running on version TLS 1.3 and server is running on TLS 1.2?

How will be cipher selected when a Client is running on version TLS 1.3 and server is running on TLS 1.2 knowing that cipher list provided by TLS 1.3 client will be different than the version ...
1
vote
1answer
287 views

Can I use a random number generator with seed for key derivation?

I don't know a thing about cryptography so I'm judging by what I see in APIs docs. I want to use ECDSA or ECDH in my project. And what I know so far about key derivation in this systems is that they: ...
2
votes
1answer
76 views

How to encrypt sensitive files in a business application? Is it needed?

I'm currently working on a business Java application, and we store sensitive files related to our users. What is the appropriate approach to store them securely? Is it viable to encrypt/decrypt all ...
4
votes
2answers
183 views

Can Pseudorandom values be used as secure keys?

I want to derive $n$ keys from a master key. I pick a master key $mk$ and use pseudo-random function (PRF) to generate $n$ pseudo-random values, $v_i=PRF(mk,i)$ where $1\leq i \leq n$. Next, I use ...
1
vote
0answers
39 views

How to implement correctly a “secure” authentication protocol? [on hold]

Due to my lack of knowledge in this matter I am facing some problems to identify which features are sign of a bad implementation of a symmetric authorization application. As I am concerned the system ...
2
votes
1answer
57 views

What key is used to encrypt the certificate and certificate verify message in TLS1.3?

Which key is used to encrypt certificate and certificate verify message in TLS1.3? I could not figure out which one it is reading section 4.4.2 of RFC 8846 and I only saw a vague mention on page 11.
3
votes
3answers
95 views

Are XOFs and KDFs more usable than DRBGs?

CSPRNGs have 2 design requirements: output unpredictability, back-tracing resistance. In addition to which, NIST SP 800-90Ar1 added other features such as a) instance customization/personalization,...
0
votes
1answer
39 views

What SALT value will be used in HKDF_EXTRACT in TLS1.3?

What SALT value will be used in HKDF_EXTRACT while generating the Handshake Secret (when there will not be any PSK)?
1
vote
0answers
81 views

Which 'info' and 'salt' parameters to use in HKDF for TLS 1.3?

all the following discussion is for HKDF in TLS1.3: Regarding the 'salt' parameter in - HKDF-Extract(salt, IKM) as written in RFC 5869: HKDF without having to protect the secrecy of the salt. In ...
1
vote
0answers
51 views

Strongswan KDF Test

How can a KDF implementation for IKEv2 application, specifically in strongswan implementation case can be verified for conformance with NIST SP800-135, please? SP800-135 KDF recommendation further ...
2
votes
1answer
59 views

How do i approach file encryption using encrypt-then-mac? [duplicate]

I'm programming a cryptographic application that encrypts files, locked with the password the user supplies. It's not intended to be used in production. It's a project for me to learn more about ...
5
votes
1answer
381 views

Use RSA keys to derive AES key

I have 2 end points where I would like to derive the same AES key. Every end point has its own RSA key pair and RSA public key from the other end point, and I would like to combine them somehow on ...
4
votes
1answer
107 views

Why derive keys from a master key instead of generating random keys?

I noticed AWS KMS generates encryption keys based off of a master key, using a key derivation function (HKDF). What's the practical advantage of deriving keys based on a master key? Isn't it simpler ...
2
votes
1answer
386 views

ECDH security when no KDF is used

Let's suppose our device performs ECDH with a fixed, unknown, private key $\text{prv}$. It accepts as input any point $Q$ lying in the proper subgroup of the proper elliptic curve, then computes: $P =...
4
votes
0answers
147 views

Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information of its advantages against CBC ...
3
votes
2answers
134 views

How to generate a good symmetric secret key

I would like to generate a good secret key, that later will be used to encrypt data symmetrically. I am not sure how to generate a good secret key. I use Linux, I am not sure which sources of ...
1
vote
1answer
60 views

Does encrypting a result of AES block cipher provide more security?

I would like to know if encrypting a result of AES256 block cipher provides more security. Concretely, I am developing a system in which a client sends to a server a ciphertext encrypted with AES256. ...
2
votes
1answer
396 views

NIST SP800-108 KDF modes comparison

According to NIST SP800-108, there are three modes that can build KDF from PRF: counter mode, feedback mode and double-pipeline iteration mode. Assume that the same PRF and input distribution are used,...
2
votes
1answer
79 views

Using a KDF (PBKDF2) properly

I am new to crypto. I have a password for my user, e.g. &&38:while:HAVE:havana:60&& I want to encrypt several documents with 10 pages each with AES....
8
votes
1answer
1k views

Is deriving the IV from the password secure?

I came across an encryption scheme to encrypt files with AES-256. You can see the initialization of the decryption routine below: ...
8
votes
1answer
3k views

argon2 vs scrypt

It's a fact that scrypt and argon2 are the two dominant memory hard KDFs. But which one of them is more recommendable for password hashing? scrypt is older and as far as I know resistant to almost ...
5
votes
1answer
137 views

Is it secure to cascade KDFs

I would like to know if the following process to generate keys for a set of devices is secure. Let’s say I have a 128-bit master key MK with high entropy. I use a KDF to generate a 128-bit device key ...
1
vote
2answers
40 views

How secure is a book derived key and what can be done to strenghten it? [duplicate]

If you have a manual encryption system where the keying is done by extracting a key from a book, a major weakness is that an adversary can search trough all existing books to find a perfect Match and ...
3
votes
1answer
423 views

Bitwise method of generating r for RSA-KEM

It seems that RSA-KEM has a very troublesome method of generating the secret $r$. It seems that the random value needs to be in the range $0 \le r \le {n - 1}$. Now most cryptographic environments ...
1
vote
1answer
125 views

Is SHA-256 OK to use for key derivation for a key that is never persisted?

The scenario: On the one side a user enters a pass phrase to encrypt a stream of data (AES-GCM) and a symmetric encryption key is derived from the pass phrase using plain SHA-256 (so not a slow ...
4
votes
1answer
150 views

What is this EC key derivation method called?

I'm looking to identify the EC key derivation method used in Hyperledger Fabric. I can't find anything in the docs or the protocol specs, but the functions' code is here for the private key and the ...
2
votes
1answer
121 views

How to safely derive a value from a secret?

I have a use case of symmetric encryption with a single-use random key K known only by the sender and the receiver: In my scheme, Bob is able to send beforehand a tiny amount of information to Alice. ...
6
votes
2answers
662 views

Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?

I have a following use case: User has his master public (sk) - private (pk) key pair (Ed25519). In DB we store a public key. Is ...
3
votes
2answers
379 views

KDF followed by a Hash?

It is my understanding that a KDF adds entropy, whereas a hash loses information. I've read that KDF should be used to store passwords. I don't understand why we don't use a KDF and then a hash, so ...
5
votes
1answer
2k views

What is the GnuPG process for going from a passphrase to a symmetric key?

Suppose I use GnuPG to symmetrically encrypt a file like so: gpg --no-options -c --cipher-algo AES256 --no-random-seed-file -o my.out my.file I then provide a ...
7
votes
3answers
235 views

Formal description of KDF1 and KDF2

I've seen many descriptions of KDF1 and KDF2 by now, but most documents simply point to specifications that are behind a pay wall. These standards are not specific to the KDF's; they just use these ...
1
vote
0answers
43 views

Reason for including the public key of the key agreement in the KDF

I found the following text when looking up KDFs: In comparison, the so-called DHAES mode in IEEE 1363a mandates to use the binary representation of the sender’s public key as an input parameter. ...
2
votes
1answer
73 views

Generating a key pair using a signature generated by an existing key

I’ve built an app in which each user has a private/public key pair and I want to generate a second one for them, however I cannot store the second private key anywhere. What would be the drawbacks ...
2
votes
1answer
71 views

What should I use for consequent AES key derivation?

I am writing a small chat program to explore some methods and concepts in cryptography and currently I am using a shared AES key tunneled with RSA which upon further reading revealed many flaws both ...
1
vote
1answer
28 views

Restricting output of key derivation function

Are there any suitable key derivation functions that allow the output to have certain constraints applied to them?` I know you can choose a length in some functions (HKDF for example), but what about ...
4
votes
1answer
149 views

How is the inter and the intra distance of a PUF calculated?

I was wondering, if I want to calculate the intra distance of a PUF, and I have already measured $n$ times a response to a challenge. Do I choose one reference value and compare the hamming distance ...
5
votes
3answers
725 views

Blake2B as a KDF

How would one go about using vanilla keyed Blake2B as a KDF with high-entropy inputs. Assume I don't have access to more specialized algorithms such blake2XB, HKDF, etc. Salt - high entropy per-...
2
votes
1answer
44 views

HKDF on output key material of previous HKDF

I understand the typical way to use HKDF is to make one call to HKDF to obtain multiple keys. Is it safe to use HKDF the following way to generate different keys ? If not, why? key0 = HKDF-extract-...
2
votes
1answer
70 views

What is meant by domain separation in the context of KDF?

This is a quote from my cryptography notes: If $h$ is a random function oracle of output length $n$ then also the two KDF constructions: $K(x) = h([0] \| x) \ldots \| h([L] \| x)$ $K(x) = ...
2
votes
1answer
329 views

Is it safe to split the output of PBKDF2?

I would like to know if splitting a key generated by PBKDF2 to derive two keys is a safe practice. Concretely, in my system, I need to derive two keys. One for symmetric cipher used in the client ...
3
votes
1answer
1k views

Questions about the argon2 options

So because I am currently working on a Project in which I will use Argon2 I need some answers to questions about the options of Argon2. I didn't find anything about them. What exactly does the ...
2
votes
1answer
54 views

Protocol that generates keys every 2 minutes using KDC

I am using a Key Distributed Center (KDC) and a key distribution protocol such as Kerberos. In order to limit the amount of ciphertext produced with the same key, I want to renew the session keys ...
2
votes
1answer
69 views

For two LUKS volumes made with the same password, can stealing the encryption key from one volume allow access to the other?

A running computer has two LUKS volumes that were made with the same password. One volume is open (key is in RAM), the other is closed. If the running computer is stolen, is the closed volume safe? ...
1
vote
1answer
648 views

DUKPT MAC Variant key

I'm currently implementing an interface that makes use of the DUKPT (Derived Unique Key Per Transaction) scheme to generate MAC keys. This particular interface uses a different (variant) of the MAC ...
4
votes
1answer
54 views

Is there an advantage to using a hash in combination with a key-derivation function?

Note: This question was originally asked at Information Security Stack Exchange, but was moved here due to a topic overlap. It is currently recommended by OWASP to use an adaptive key-derivation ...
5
votes
1answer
127 views

Is It Safe to Reuse the Same Salt in Bcrypt Password Hash (Specifically for Chaining Hashes)

As explained in my previous question, I want to develop a scheme which would be able to increase the password hash strength without the user password. According to Thomas Pornin it should be safe to ...
3
votes
1answer
88 views

Can this key revocation scheme using hierarchical deterministic keys work?

Assume I am working with crypto that supports hierarchical deterministic key generation, Bitcoin/Ethereum keys using secp256k1 is one example. There is a decentralised key registry where users ...
2
votes
0answers
68 views

Derivable encryption key - BIP0032 parallel

I wish to find an asymmetric encryption algorithm that supports key derivation, BIP0032 style. Meaning that I have some SEED [PRIV] and I give someone some public data [PUB], then given new public ...
2
votes
0answers
74 views

Is my deniable encryption scheme reasonable?

I was experimenting with RubberhoseFS, but since it is very hard to compile on anything modern, I decided to implement my own version, stripped of many unnecessary features. Namely, my implementation ...
1
vote
1answer
72 views

Continuous logarithms in cryptography

Cryptographic procedures seem to almost exclusively use discrete logarithms rather than continuous logarithms. Hence, I assume there are good and sound reasons for this. In essence, answers provided ...