Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
4
votes
2answers
1k views

Mathematical formula for switching the key for OTP?

Instead of generating the random key for the one time pad cipher over and over again, is there a mathematical formula that allows you to switch the key to a new key? The new key must be as random and ...
16
votes
1answer
3k views

Security of KDF1 and KDF2 (hash based KDF's)

It's still common to come across implementations of KDF1 and KDF2. Basically these are KDF's that simply derive multiple keys from the key seed and a counter: $K_i = \operatorname{KDF}(K_{master}, i) ...
27
votes
4answers
25k views

How can one securely generate an asymmetric key pair from a short passphrase?

Background info: I am planning on making a filehost with which one can encrypt and upload files. To protect the data against any form of hacking, I'd like not to know the encryption key ($K$) used for ...
21
votes
2answers
6k views

Deriving Keys for Symmetric Encryption and Authentication

So here's the concept. Rather than storing 2 keys and using a random IV, which presents its own problems (key rotation, ensuring no key is used in more than 2^32 cycles, sharing the keys, etc), is it ...
8
votes
4answers
1k views

Which risks are associated with deriving multiple keys from the same DH secret Z?

NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment. NIST ...
9
votes
1answer
1k views

How random is the shared secret in the Diffie Hellman key agreement

How random is the value $ZZ$ in the DH protocol? This question was triggered by this somewhat naïve implementation in I2P shown by Sergei at Stackoverflow. Obviously $ZZ$ is distinguishable from a ...
7
votes
2answers
12k views

Key derivation functions (KDF): What are? Main purposes? How can they be used?

What are KDFs? What are their main purposes? How they can be used, in other words, what's their drill in a cryptography scheme?
19
votes
6answers
2k views

Why does PBKDF2 xor the iterations of the hash function together?

The definition of PBKDF2 states that I obtain a derived key (1) by calling a pseudorandom function a bunch of times recursively: $U_1 = PRF(password, salt)$ $U_2 = PRF(password, U_1)$ … $U_n =...
3
votes
1answer
6k views

DES Key Schedule Algorithm

Reading through the DES Specification it says that the keys are permuted with PC-1 initially and then shifted left both $C$ and $D$. However, before it gets ...
2
votes
2answers
210 views

Key Derivation Functions vs. Password Hashing Schemes

Key derivation functions, such as HKDF (standardized in RFC 5869), are meant to stretch some initial keying material having enough entropy, like a Diffie-Hellman shared value, into one or more strong ...
18
votes
5answers
29k views

PBKDF2 and salt

I want to ask some questions about the PBKDF2 function and generally about the password-based derivation functions. Actually we use the derivation function together with the salt to provide ...
13
votes
3answers
3k views

PBKDF2 for key diversification

I am looking for a secure key diversification function to create individual AES keys for a local smart card deployment. The keys need to be derived from a secret master key and the smart card serial ...
11
votes
2answers
6k views

Deterministically generate a RSA public/private key pair from a passphrase (with sufficient entropy)?

Is it possible to deterministically generate public/private RSA key pairs from passphrases? Would giving the (key generating) algorithm data made from key-stretching the passphrase (instead of a ...
9
votes
1answer
2k views

How to salt PBKDF2, when generating both an AES key and a HMAC key for Encrypt then MAC?

When using Encrypt-then-MAC with AES and HMAC by password, and given 128 bits of payload with the ciphertext to store a random salt, which would be more secure: Using PBKDF2 with then entire 128 bit ...
6
votes
3answers
349 views

Formal description of KDF1 and KDF2

I've seen many descriptions of KDF1 and KDF2 by now, but most documents simply point to specifications that are behind a pay wall. These standards are not specific to the KDF's; they just use these ...
7
votes
1answer
2k views

Is the AES Key Schedule weak?

After reading this paper entitled Key Recovery Attacks of Practical Complexity on AES Variants With Up To 10 Rounds I was left wondering why the key schedule of AES is invertable. In the paper the ...
3
votes
1answer
453 views

ECDH security when no KDF is used

Let's suppose our device performs ECDH with a fixed, unknown, private key $\text{prv}$. It accepts as input any point $Q$ lying in the proper subgroup of the proper elliptic curve, then computes: $P =...
19
votes
0answers
3k views

What's the difference between a Key Derivation Function and a Password-Hash? [duplicate]

It seems to me that anything that was sufficiently good as a KDF would work just fine as a password hash, though the reverse might not be true. Are there considerations specific to password-hashing ...
16
votes
2answers
2k views

Is bcrypt better than GnuPG's iterated+salted hashing method?

GnuPG has slow hash built-in in form of iterated+salted S2K. Does it have disadvantages in comparison with bcrypt or scrypt? Is GnuPG's slow hash method easily automated in GPUs?
12
votes
2answers
8k views

What is the difference between Scrypt and PBKDF2?

After reading these two resources I am wondering am I getting all the differences between Scrypt and PBKDF2. As far as I understood, the similarity is: both are password-based key derivation ...
4
votes
1answer
381 views

Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?

PBKDF2 should only be used to generate a larger output than the hash function it uses if the output is used in such a way that it has a flat keyspace. As far as I am aware, XTS does not have a flat ...
12
votes
2answers
1k views

Can any MAC be used as a KDF?

First, let me clarify what I mean with a Key Derivation Function (KDF). I'm interested in KDFs that take an $n$-bit symmetric master key and some diversification data of arbitrary length as input and ...
4
votes
1answer
3k views

RSA key pair generation using PRNG with same seed

I see a lot of Q/A where persons are trying to generate a specific key pair using static data such as a password. Now say we use a known PRNG (dangerous assumption), seeded with a the data as a static ...
6
votes
2answers
1k views

What exactly does s2k do in gpg

So I recently discovered the --s2k mode in gpg. Sadly it is not very well-documented. I mean, what is ...
4
votes
1answer
2k views

Is a PBKDF2-derived master key easier cracked if very many Data Protection Keys are derived from it?

I'm referring the NIST document about PBKDF2, NIST Special Publication 800-132, Recommendation for Password-Based Key Derivation, Part 1: Storage Applications, Page 8 and 9, section 5.4 Using the ...
2
votes
3answers
150 views

Are XOFs and KDFs more usable than DRBGs?

CSPRNGs have 2 design requirements: output unpredictability, back-tracing resistance. In addition to which, NIST SP 800-90Ar1 added other features such as a) instance customization/personalization,...
5
votes
1answer
891 views

Computing IV for CBC from PBKDF2 + HKDF

Note that this question is somewhat similar to Can I use my random IV (for AES) as a salt for PBKDF2? My current encryption format computes two random PBKDF2 salts (encryption and HMAC, 8 bytes each) ...
4
votes
1answer
1k views

Clarification needed in TLS 1.2 key derivation process

Reference to TLS 1.2 standard documentation section 6.3 regarding the key generation here: To generate the key material, compute ...
3
votes
1answer
1k views

Encryption and HMAC key derivation

I'm deriving keys from a user-supplied passphrase for symmetric encryption using AES-256 in CBC mode with a HMAC for authenticity/integrity. My key derivation function currently looks like this: ...
3
votes
3answers
404 views

Memory hard key derivation (password hash) using AES encryption

I am restricted on a certain environment involving PHP and am currently unable to implement new memory hard hashes such as scrypt (and I am not trying to compete with the likes of scrypt). My ...
2
votes
1answer
708 views

Is this key management scheme secure?

I'm designing a scheme for management of a small number of cryptographic keys (< 100 at any given time) and I had an idea: rather than storing all the keys, could I just store one master key and ...
2
votes
1answer
358 views

Is it safe to split the output of PBKDF2?

I would like to know if splitting a key generated by PBKDF2 to derive two keys is a safe practice. Concretely, in my system, I need to derive two keys. One for symmetric cipher used in the client ...
2
votes
3answers
732 views

Entropy of system data - use all and hash, or trim least significant bits?

I'm working on a background entropy collector for key generation that monitors hardware and produces an entropy pool. Here's my list of sources: Mouse position Keyboard timings (i.e. time between ...
1
vote
0answers
734 views

DUKPT MAC Variant key [closed]

I'm currently implementing an interface that makes use of the DUKPT (Derived Unique Key Per Transaction) scheme to generate MAC keys. This particular interface uses a different (variant) of the MAC ...
34
votes
1answer
23k views

Password hashing security of argon2 versus bcrypt/PBKDF2?

I wonder if it can be approximated how much of a security margin the new argon2 hash, winner of the password hashing competition, can give over bcrypt or PBKDF2, for an attacker using large GPU ...
6
votes
2answers
704 views

Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?

I have a following use case: User has his master public (sk) - private (pk) key pair (Ed25519). In DB we store a public key. Is ...
17
votes
1answer
1k views

Compressing EC private keys

For reasonable security, EC private keys are typically 256-bits. Shorter EC private keys are not sufficiently secure. However, shorter symmetric keys (128-bits, for example) are comparably secure. I ...
5
votes
1answer
1k views

What information to include is the 'info' input for HKDF?

The RFC states the following: 3.2. The 'info' Input to HKDF While the 'info' value is optional in the definition of HKDF, it is often of great importance in applications. Its main objective ...
5
votes
2answers
4k views

How secure is it to use password as AES key?

I am developing a steganography app where user encrypt any file into an audio file. The user can enter a password to protect the hidden data. The same password is converted as a 256 bit key and the ...
4
votes
2answers
2k views

Is SHA 2 suitable for key derivation?

Let's imagine that I've got a number modulo n given by DH protocol. I want to use it as a key for AES encryption. So I have to cut this number to fit it in AES (...
3
votes
4answers
2k views

Why is Bcrypt called a Key Derivation Function?

I am trying to understand why is bcrypt called a Key Derivation Function? I looked up the details of Ekfblowfish on Usenix article. After reading it, I understood that: The password is the ...
1
vote
2answers
1k views

Deriving 2 keys using HKDF

I have an encryption scheme that uses a 256-bit master key, from which 2 separate keys (one for AES-256-CTR encryption and one for a HMAC-SHA256) are derived using HKDF. However, I'm not sure exactly ...
7
votes
2answers
811 views

Multiple iterations of AES for key derivation?

The keepass password manager uses multiple rounds of AES for its key derivation, as described here. I was somewhat surprised that it wasn't using pbkdf2, bcrypt, or something more common. ...
7
votes
2answers
4k views

How key materials are generated in SSL V3 from master secret

The generation of key materials is given by ...
7
votes
4answers
4k views

Creating an encryption key from several other keys and using hash functions

I want to combine two or more keys to create a single encryption key that relies on all of them. What is the proper method for doing that? Simple XOR? Using hash functions? Something else? I ...
6
votes
2answers
795 views

Secure way to derive separate encryption and MAC keys from a single master key?

I want to derive a 256 bit encryption key and a 256 bit MAC key from a single 256 bit master key for an authenticated encryption scheme. I was considering the following construction to derive the two ...
6
votes
2answers
312 views

Are there any high level memory-hard PBKDF constructions?

The PBKDF2 construction from PKCS #5 v2 has the convenient feature that it can be implemented using only standard interchangeable cryptographic primitives. Specifically, it only requires the ...
5
votes
2answers
3k views

How to derive a symmetric key from ECDH shared secret?

I am trying to implement the internal primitives of ECDH. Currently I'm able to multiply the receiver's public EC point with the sender's private key to arrive at the shared EC point. Next step is to ...
4
votes
1answer
295 views

Does EAX use the same keys for encryption and authentication?

I am actually checking use of EAX AEAD mode, and following EAX spec review (scheme definition for my part), my question is: what about the derivation of the authentication and encryption keys? In the ...
6
votes
1answer
2k views

How is HKDF-Expand better than a simple hash?

Why do we need HKDF-Expand if we can simply hash the pseudorandom key to make it longer? The docs (in the link) say: The second stage "expands" the pseudorandom key to the desired length... Is ...