Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

4
votes
1answer
263 views

Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?

PBKDF2 should only be used to generate a larger output than the hash function it uses if the output is used in such a way that it has a flat keyspace. As far as I am aware, XTS does not have a flat ...
2
votes
1answer
54 views

Reveal all information up to n-th message

Is there a way to generate a sequence of keys that have the property that exposing any of those keys will reveal all previous keys, but no future key? I'm thinking about an application that sends an ...
0
votes
2answers
194 views

Multiple key generator

I need an algorithm for "key generator". It should be initialized with some secret data, such as a (hashed) passphrase, or something generated once by some 3rd-party code. Given some small input it ...
1
vote
1answer
30 views

Encryption program conseil

I'm writing a little program to encrypt and decrypt a file. I'm using AES encryption in CTR mode that takes a key generated by a KDF (script). I have read some articles about cryptography but I have ...
1
vote
0answers
29 views

Time-sensitive key derivation for sharing with third-party

Devices: In this system, users have one or more wearable devices (a smart watch), one of which they will most likely have on their person all the time. The devices are linked to their account by their ...
3
votes
1answer
151 views

Combining multiple cryptographic keys to generate an encryption key

We have a system that has several SecretKeys (for example, one for a user, and one for us). We want to encrypt data in a way that requires all of those keys to be available in order to decrypt. I ...
3
votes
2answers
140 views

Using HKDF to derive symmetric keys from a hybrid public-key encryption scheme

RFC 5869 describes HMAC-based Extract-and-Expand Key Derivation Function (HKDF). In section 4, entitled "Applications of HKDF", it states that one of the intended uses is: derivation of symmetric ...
0
votes
1answer
57 views

is it safe to leak some information about scrypt result?

I am encrypting a file via AES-CBC and am using scrypt to extract a key from a user-provided password. The IV is public and is stored with the encrypted file. Is it safe to generate my IV (public) ...
-4
votes
1answer
86 views

How to reversely compute from hash [closed]

What are practical methodologies to derive the following ciphertext: 1bd0d370b262d748b21c40cc7e5746642b4c06079a224c65e443e429289753c2
2
votes
0answers
80 views

Can proofs be relayed to derived keys?

I am aiming to find out if this problem/puzzle can be solved with cryptography at all. Say there are these two parties: Subject S which has a master private/public key pair (MPriv, MPub) and a set of ...
4
votes
1answer
237 views

How secure is using a hash function as Key Derivation Function?

I am developing a personal project and I have the following need: given a randomly generated seed (with enough entropy) I need to generate a number $x$ of Ed25519 key pairs. These key pairs are not ...
2
votes
1answer
68 views

Can private key be specified on key pair creation?

Without regards to any specific implementation of asymmetric cryptography, I am wondering if it is feasible to come up with a value of private key I want to use, and calculate the corresponding public ...
3
votes
0answers
55 views

Did “The Catena Password-Scrambling Framework” make an error in the reduction of its pseudorandomness?

I was reviewing the most recent version of the Catena paper and they made some claims that I find questionable in their reduction of the pseudorandomness of the output of Catena (p. 32). First I will ...
4
votes
1answer
95 views

PBKDF security if all but one keys are exposed

I'm trying to understand the security of KDF but stuck with PBKDF case (case 3). Suppose, we have the following settings: $KDF(SK,salt_1) \rightarrow k_1$ $KDF(SK,salt_2) \rightarrow k_2$ The ...
2
votes
0answers
185 views

The right way to encrypt sensitive data with an user password

I am developing something like 1Password and I want to be sure that method that I use is secure. Main idea of the app is storing user passwords, and is protected with a global master password. Main ...
11
votes
2answers
2k views

Why does Signal repeatedly hash the secure passphrase?

Background: I'm working on creating a small program to extract my messages from Signal's newly-added (beta) encrypted backup feature. In the Signal codebase for their Android app, I noticed that ...
1
vote
0answers
106 views

HKDF to derive multiple keys from a strong constant master secret and a weaker changing secret

I am working with constrained nodes (type OpenMote CC2538) on a (constrained) 6TiSCH network and I am trying to design a good re-keying scheme designed to generate AES-128 keys dubbed Device ...
1
vote
0answers
129 views

Problems key AES 128 key from last round key

I have written an algorithm in Python to find the main AES 128 key from the last round key. However, it doesn't work; I can not find back my main key. I know that the general principle is to do $w[i] ...
3
votes
1answer
256 views

Why does NIST SP 800 `KDF in Counter Mode' specification require a PRF rather than a PRP?

This is the NIST SP 800 KDF in Counter Mode specification. Where $K_I$ is the input key, $[i]_2$ is the counter value, Label and Context are fixed-length strings and $[L]_2$ is the output size, the ...
4
votes
1answer
89 views

What is the reasoning behind the PRESENT key schedule?

It seems there are few books on PRESENT and even fewer that give any reasoning behind the mechanics of the key schedule. I understand how it works to the extent that I made a simple Excel program of ...
0
votes
0answers
58 views

Using OpenSSL to emulate LTO 4 tape encryption

I have a mix of LTO 4 and LTO 3 tapes I would like to encrypt data on to. LTO 4 has built in encryption - load they key into the drive, and it handles the AES-256-GCM encyption transparently. LTO 3 ...
3
votes
2answers
143 views

How can a hash function be suitable for hashing passwords, but not for deriving enctyption keys, and vice versa?

Not being a specialist in this field, I am nevertheless constantly trying to keep up with which methods are being considered secure for storing passwords and for encrypting data. During my research ...
2
votes
2answers
258 views

Attribute Authentication in Attribute Based Encryption (ABE)

When a data user requires access it asks the key issuer to generate a key for it using the specified attributes. How does the key issuer authenticate that the data user actually acquires the ...
0
votes
1answer
276 views

Web Crypto API - deriveKey vs. deriveBits? [closed]

I have some questions about deriveKey and deriveBits for web crypto API. I am confused about the state of these APIs. I do ...
0
votes
0answers
106 views

Is it more secure to derive a symmetric key with a timestamp?

I see a lot about derived keys for signing messages, but not for encrypting messages. AWS's SigV4, for example, includes the timestamp when deriving the signing key. Would it make sense to use public ...
4
votes
3answers
189 views

Anti-spamming hash-based proof-of-work?

I'm planning to implement a public mailbox for receiving feedback, and I'd like to use hash-based proof-of-work to frustrate spammers. First, we want to use 320-bit capacity Gimli permutation as the ...
1
vote
1answer
364 views

How to extract MAC and AES keys using x9.63 based kdf

For trying ECIES, I need to derive keys for MAC and AES from the shared secret using ANSI x9.63 based KDF. The information on key derivation I got it from Section 3.6.1 of http://www.secg.org/sec1-v2....
4
votes
1answer
97 views

How is the inter and the intra distance of a PUF calculated?

I was wondering, if I want to calculate the intra distance of a PUF, and I have already measured $n$ times a response to a challenge. Do I choose one reference value and compare the hamming distance ...
0
votes
1answer
761 views

Questions about future and session key generation in DUKPT process

As I understand this process is done in the client device for generating a unique key per transaction: inject generated IPEK to client device; generate set of future keys (actually 21 future keys) ...
3
votes
1answer
203 views

Double Ratchet Algorithm - What if the receiving wants to send the second message before the initiator?

I'm studying about Signal Protocol and I had a doubt in Double Ratchet Algorithm. This section describes how to derive the receiving and sending key messages. But in this scenario, only Alice can send ...
4
votes
1answer
238 views

Is the seed/salt input of a Key Derivation Function confidential?

I'm implementing a security protocol and for the key management a scheme is proposed using a key derivation function on the remote device. Thereby the input seed is uploaded in plaintext to the remote ...
0
votes
1answer
40 views

Use signed email as method for deriving encryption key

I'm trying to create a solution to decrypt a file at rest on a server by sending an email to a given address and receiving a reply from that address. I'm struggling to see if its possible and haven't ...
1
vote
1answer
67 views

Salt for non stored passwords

I read a lot about the concept of adding a salt to a password and understand that it protects against rainbow table etc. attacks. But this kind of attacks are based on getting access to the server ...
2
votes
1answer
54 views

Pepper and key derivation/stretching

I understand the pepper concept of adding but not storing a secret and iterating through the set of possible secret values for verifying. But is pepper also useful when it comes already to the use of ...
1
vote
0answers
227 views

Can I use a random number generator with seed for key derivation?

I don't know a thing about cryptography so I'm judging by what I see in APIs docs. I want to use ECDSA or ECDH in my project. And what I know so far about key derivation in this systems is that they: ...
0
votes
1answer
159 views

Generating 1024 bits of entropy from a seed

I need to generate 1024 pseudo-random bits from a 100 bytes string seed (only valid lowercase chars) One thing I'm pretty sure would be secure enough would be to repeat this 100 bytes string 20 times ...
4
votes
1answer
57 views

Key Derivation Functions offering better than 2^hlen security?

On page 21 of his HKDF paper, Krawczyk criticized one of the stated desirable features of KDFs from the paper “On The Security of Key Derivation Functions” (Emphasis mine): Due to the way the hash ...
3
votes
1answer
368 views

Is it secure to use so many iterations of AES-CBC as a KDF so that it's slow even using AES-NI?

Note: This is not the same as Multiple iterations of AES for key derivation?. Almost everyone has AES-NI nowadays - when building a cryptographic application, is is possible to leverage this to ...
1
vote
1answer
567 views

DUKPT MAC Variant key

I'm currently implementing an interface that makes use of the DUKPT (Derived Unique Key Per Transaction) scheme to generate MAC keys. This particular interface uses a different (variant) of the MAC ...
0
votes
1answer
200 views

What operation does $\|$ denote in ANSI X9.63 KDF? [duplicate]

Can someone tell me in laymens terms what this is? $$K_i = \mathrm{Hash}(Z \| \mathit{Counter} \| [\mathit{SharedInfo}])$$ What do the double pipes represent?
4
votes
2answers
1k views

Why does openssl derive IVs from a password?

From https://wiki.openssl.org/index.php/Manual:Enc(1): When a password is being specified using one of the other options, the IV is generated from this password. Why does OpenSSL do this? My ...
3
votes
1answer
141 views

Necessary to authenticate nonce if authentication-key is derived from nonce?

Lets suppose my messages are composed like this: unique_message_nonce + encrypted_message + mac Because I don't have an AEAD-scheme, I can encrypt and authenticate ...
-1
votes
1answer
339 views

Key Derivation Function (KDF) Usage [closed]

Is it common to have a KDF implementation in order to safely store passwords? Do IT-companies use KDF? Or do they usually rely on other algorithms? If you have any practical example for the second ...
4
votes
2answers
198 views

Can we have single hash function both for data integrity and key derivation function?

Can we have single hash function both for data integrity and key derivation function? Why and Why not? Any link describing difference analytically will be appreciated. Thanks.
5
votes
1answer
759 views

Clarification needed in TLS 1.2 key derivation process

Reference to TLS 1.2 standard documentation section 6.3 regarding the key generation here: To generate the key material, compute ...
1
vote
1answer
658 views

The number of keys generated in TLS 1.2?

In section 6.3. Key Calculation in the standard documentation here, I see the following: The master secret is expanded into a sequence of secure bytes, which is then split to a client write MAC ...
3
votes
1answer
189 views

Does it matter whether the KDF salt is integrity protected?

I am writing a simple application, mainly as a fun challenge, but also to hopefully someday use as my password manager. I'm using pynacl's SecretBox, which ...
0
votes
0answers
105 views

Derivative of a symmetric encryption key

Let generate a master symmetric key mSk We encrypt a file F using mSk; and upload it in a ...
7
votes
1answer
2k views

argon2 vs scrypt

It's a fact that scrypt and argon2 are the two dominant memory hard KDFs. But which one of them is more recommendable for password hashing? scrypt is older and as far as I know resistant to almost ...
4
votes
3answers
982 views

How likely is a AES KDF bypass?

So I was wondering about some alternative attack scenario which I thought of when I started to understand KDF's . So lets say you have a cipher like AES and a strong KDF . And the legit user uses a ...