Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

3
votes
1answer
68 views

Why derive keys from a master key instead of generating random keys?

I noticed AWS KMS generates encryption keys based off of a master key, using a key derivation function (HKDF). What's the practical advantage of deriving keys based on a master key? Isn't it simpler ...
2
votes
1answer
362 views

ECDH security when no KDF is used

Let's suppose our device performs ECDH with a fixed, unknown, private key $\text{prv}$. It accepts as input any point $Q$ lying in the proper subgroup of the proper elliptic curve, then computes: $P =...
4
votes
0answers
98 views

Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information of its advantages against CBC ...
3
votes
3answers
102 views

How to generate a good symmetric secret key

I would like to generate a good secret key, that later will be used to encrypt data symmetrically. I am not sure how to generate a good secret key. I use Linux, I am not sure which sources of ...
0
votes
1answer
51 views

Does encrypting a result of AES block cipher provide more security?

I would like to know if encrypting a result of AES256 block cipher provides more security. Concretely, I am developing a system in which a client sends to a server a ciphertext encrypted with AES256. ...
2
votes
1answer
387 views

NIST SP800-108 KDF modes comparison

According to NIST SP800-108, there are three modes that can build KDF from PRF: counter mode, feedback mode and double-pipeline iteration mode. Assume that the same PRF and input distribution are used,...
2
votes
1answer
71 views

Using a KDF (PBKDF2) properly

I am new to crypto. I have a password for my user, e.g. &&38:while:HAVE:havana:60&& I want to encrypt several documents with 10 pages each with AES....
8
votes
1answer
1k views

Is deriving the IV from the password secure?

I came across an encryption scheme to encrypt files with AES-256. You can see the initialization of the decryption routine below: ...
8
votes
1answer
3k views

argon2 vs scrypt

It's a fact that scrypt and argon2 are the two dominant memory hard KDFs. But which one of them is more recommendable for password hashing? scrypt is older and as far as I know resistant to almost ...
4
votes
1answer
357 views

Use RSA keys to derive AES key

I have 2 end points where I would like to derive the same AES key. Every end point has its own RSA key pair and RSA public key from the other end point, and I would like to combine them somehow on ...
5
votes
1answer
135 views

Is it secure to cascade KDFs

I would like to know if the following process to generate keys for a set of devices is secure. Let’s say I have a 128-bit master key MK with high entropy. I use a KDF to generate a 128-bit device key ...
1
vote
2answers
38 views

How secure is a book derived key and what can be done to strenghten it? [duplicate]

If you have a manual encryption system where the keying is done by extracting a key from a book, a major weakness is that an adversary can search trough all existing books to find a perfect Match and ...
3
votes
1answer
415 views

Bitwise method of generating r for RSA-KEM

It seems that RSA-KEM has a very troublesome method of generating the secret $r$. It seems that the random value needs to be in the range $0 \le r \le {n - 1}$. Now most cryptographic environments ...
1
vote
0answers
50 views

Which 'info' and 'salt' parameters to use in HKDF for TLS 1.3?

all the following discussion is for HKDF in TLS1.3: Regarding the 'salt' parameter in - HKDF-Extract(salt, IKM) as written in RFC 5869: HKDF without having to protect the secrecy of the salt. In ...
1
vote
1answer
96 views

Is SHA-256 OK to use for key derivation for a key that is never persisted?

The scenario: On the one side a user enters a pass phrase to encrypt a stream of data (AES-GCM) and a symmetric encryption key is derived from the pass phrase using plain SHA-256 (so not a slow ...
4
votes
1answer
146 views

What is this EC key derivation method called?

I'm looking to identify the EC key derivation method used in Hyperledger Fabric. I can't find anything in the docs or the protocol specs, but the functions' code is here for the private key and the ...
2
votes
1answer
118 views

How to safely derive a value from a secret?

I have a use case of symmetric encryption with a single-use random key K known only by the sender and the receiver: In my scheme, Bob is able to send beforehand a tiny amount of information to Alice. ...
6
votes
2answers
651 views

Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?

I have a following use case: User has his master public (sk) - private (pk) key pair (Ed25519). In DB we store a public key. Is ...
3
votes
2answers
375 views

KDF followed by a Hash?

It is my understanding that a KDF adds entropy, whereas a hash loses information. I've read that KDF should be used to store passwords. I don't understand why we don't use a KDF and then a hash, so ...
5
votes
1answer
2k views

What is the GnuPG process for going from a passphrase to a symmetric key?

Suppose I use GnuPG to symmetrically encrypt a file like so: gpg --no-options -c --cipher-algo AES256 --no-random-seed-file -o my.out my.file I then provide a ...
6
votes
3answers
212 views

Formal description of KDF1 and KDF2

I've seen many descriptions of KDF1 and KDF2 by now, but most documents simply point to specifications that are behind a pay wall. These standards are not specific to the KDF's; they just use these ...
1
vote
0answers
41 views

Reason for including the public key of the key agreement in the KDF

I found the following text when looking up KDFs: In comparison, the so-called DHAES mode in IEEE 1363a mandates to use the binary representation of the sender’s public key as an input parameter. ...
2
votes
1answer
71 views

Generating a key pair using a signature generated by an existing key

I’ve built an app in which each user has a private/public key pair and I want to generate a second one for them, however I cannot store the second private key anywhere. What would be the drawbacks ...
2
votes
1answer
56 views

What should I use for consequent AES key derivation?

I am writing a small chat program to explore some methods and concepts in cryptography and currently I am using a shared AES key tunneled with RSA which upon further reading revealed many flaws both ...
1
vote
1answer
28 views

Restricting output of key derivation function

Are there any suitable key derivation functions that allow the output to have certain constraints applied to them?` I know you can choose a length in some functions (HKDF for example), but what about ...
4
votes
1answer
131 views

How is the inter and the intra distance of a PUF calculated?

I was wondering, if I want to calculate the intra distance of a PUF, and I have already measured $n$ times a response to a challenge. Do I choose one reference value and compare the hamming distance ...
5
votes
3answers
692 views

Blake2B as a KDF

How would one go about using vanilla keyed Blake2B as a KDF with high-entropy inputs. Assume I don't have access to more specialized algorithms such blake2XB, HKDF, etc. Salt - high entropy per-...
2
votes
1answer
40 views

HKDF on output key material of previous HKDF

I understand the typical way to use HKDF is to make one call to HKDF to obtain multiple keys. Is it safe to use HKDF the following way to generate different keys ? If not, why? key0 = HKDF-extract-...
2
votes
1answer
52 views

What is meant by domain separation in the context of KDF?

This is a quote from my cryptography notes: If $h$ is a random function oracle of output length $n$ then also the two KDF constructions: $K(x) = h([0] \| x) \ldots \| h([L] \| x)$ $K(x) = ...
2
votes
1answer
320 views

Is it safe to split the output of PBKDF2?

I would like to know if splitting a key generated by PBKDF2 to derive two keys is a safe practice. Concretely, in my system, I need to derive two keys. One for symmetric cipher used in the client ...
3
votes
1answer
1k views

Questions about the argon2 options

So because I am currently working on a Project in which I will use Argon2 I need some answers to questions about the options of Argon2. I didn't find anything about them. What exactly does the ...
2
votes
1answer
50 views

Protocol that generates keys every 2 minutes using KDC

I am using a Key Distributed Center (KDC) and a key distribution protocol such as Kerberos. In order to limit the amount of ciphertext produced with the same key, I want to renew the session keys ...
2
votes
1answer
66 views

For two LUKS volumes made with the same password, can stealing the encryption key from one volume allow access to the other?

A running computer has two LUKS volumes that were made with the same password. One volume is open (key is in RAM), the other is closed. If the running computer is stolen, is the closed volume safe? ...
1
vote
1answer
624 views

DUKPT MAC Variant key

I'm currently implementing an interface that makes use of the DUKPT (Derived Unique Key Per Transaction) scheme to generate MAC keys. This particular interface uses a different (variant) of the MAC ...
4
votes
1answer
50 views

Is there an advantage to using a hash in combination with a key-derivation function?

Note: This question was originally asked at Information Security Stack Exchange, but was moved here due to a topic overlap. It is currently recommended by OWASP to use an adaptive key-derivation ...
5
votes
1answer
118 views

Is It Safe to Reuse the Same Salt in Bcrypt Password Hash (Specifically for Chaining Hashes)

As explained in my previous question, I want to develop a scheme which would be able to increase the password hash strength without the user password. According to Thomas Pornin it should be safe to ...
3
votes
1answer
85 views

Can this key revocation scheme using hierarchical deterministic keys work?

Assume I am working with crypto that supports hierarchical deterministic key generation, Bitcoin/Ethereum keys using secp256k1 is one example. There is a decentralised key registry where users ...
2
votes
0answers
67 views

Derivable encryption key - BIP0032 parallel

I wish to find an asymmetric encryption algorithm that supports key derivation, BIP0032 style. Meaning that I have some SEED [PRIV] and I give someone some public data [PUB], then given new public ...
2
votes
0answers
73 views

Is my deniable encryption scheme reasonable?

I was experimenting with RubberhoseFS, but since it is very hard to compile on anything modern, I decided to implement my own version, stripped of many unnecessary features. Namely, my implementation ...
1
vote
1answer
70 views

Continuous logarithms in cryptography

Cryptographic procedures seem to almost exclusively use discrete logarithms rather than continuous logarithms. Hence, I assume there are good and sound reasons for this. In essence, answers provided ...
8
votes
3answers
4k views

How many KDF rounds for an SSH key?

What is the best practice on choosing how many key derivation function (KDF) rounds/iterations when generating an SSH key pair? Am I correct in saying that it is unnecessary if the passphrase is ...
64
votes
4answers
12k views

Why does the FBI ask Apple for help to decrypt an iPhone?

The current debate of the FBI trying to get Apple to assist in decrypting an iPhone made me wonder: Normally, upon turning on an iPhone, everything is decrypted using a 4-digit pin (or actually, a ...
15
votes
2answers
2k views

Is bcrypt better than GnuPG's iterated+salted hashing method?

GnuPG has slow hash built-in in form of iterated+salted S2K. Does it have disadvantages in comparison with bcrypt or scrypt? Is GnuPG's slow hash method easily automated in GPUs?
3
votes
1answer
158 views

Where can I find official test vectors for NIST SP 800-56C r1 Single Step KDF

NIST 800-56Cr1 describes a single and two (extract-expand) step KDF designed for use in key agreement routines. NIST declares that HKDF (RFC5869) is a version of the two-step variation so test vectors ...
2
votes
1answer
64 views

How to encrypt sensitive files in a business application? Is it needed?

I'm currently working on a business Java application, and we store sensitive files related to our users. What is the appropriate approach to store them securely? Is it viable to encrypt/decrypt all ...
2
votes
1answer
62 views

Are there any known security issues when doing the following chaining of BCrypt Hashes: 'bcryt(bcrypt(user-pw, work-factor1), work-factor2)'

I am currently developing a protocol which would be able to "upgrade" the strength of a bcrypt password hashes without the knowledge of the user-password so a system may upgrade it without user ...
4
votes
2answers
3k views

How to derive a symmetric key from ECDH shared secret?

I am trying to implement the internal primitives of ECDH. Currently I'm able to multiply the receiver's public EC point with the sender's private key to arrive at the shared EC point. Next step is to ...
1
vote
1answer
86 views

Why does DH-EKE require that public keys be indistinguishable from random?

The introduction to SPAKE pre-authentication states: Diffie-Hellman Encrypted Key Exchange (DH-EKE) is the earliest widely deployed PAKE. It works by encrypting the public keys of a Diffie-Hellman ...
1
vote
1answer
95 views

What are the disadvantages of XOR key derivation?

Assume a 256-bit Key and a 256-bit Salt, with uniformly distributed entropy, both fully independent. Assume ...
2
votes
1answer
148 views

KDF based on X9.63 vs. NIST SP800-108

What is the difference between KDF based on NIST SP800-108 vs. the older one in ANSI X9.63? When should one be selected over the other? Thanks.