Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

4
votes
3answers
994 views

How likely is a AES KDF bypass?

So I was wondering about some alternative attack scenario which I thought of when I started to understand KDF's . So lets say you have a cipher like AES and a strong KDF . And the legit user uses a ...
4
votes
0answers
307 views

Use RSA keys to derive AES key

I have 2 end points where I would like to derive the same AES key. Every end point has its own RSA key pair and RSA public key from the other end point, and I would like to combine them somehow on ...
1
vote
2answers
218 views

how does hkdf generate 2 keys?

Hi I am new to cryptography and am confused as to how HKDF generates two separate keys from one single key/password. Is it as follows? Key 1: HKDF-Extract(salt, IKM) -> PRK Key 2: HKDF-Expand(PRK, ...
0
votes
0answers
127 views

3 way key derivation

We have a master key which we would like to protect. We want to derive keys for two sets of clients in such a way that client set 1 and client set 2 can mutually authenticate each other. If client set ...
4
votes
2answers
3k views

Looking at hash output – is Base64 encoding in any way better than HEX encoding?

I was wondering why most "normal/unsafe" crypto hashes like SHA-256, SHA-512, Whirlpool, RipeMD-160, MD5, etc. are HEX encoded. But most "secure" crypto hashes (KDF' ) like ...
1
vote
1answer
192 views

PKCS #11 – Deriving a Key where MSB perform encryption and LSB perform CMAC operation?

I am using Thales HSM, a PKCS #11 Compliant device. I have an 32 byte AES key and derivation input. I want to use AES-ECB encryption Mode to derive a 32 byte key where 16 MSB should be considered as ...
4
votes
1answer
425 views

Some Questions about the Veracrypt hash functions

Veracrypt has always been my favourite encryption tool since it came out . But still there are some things about the tool I don't understand . Why is there the possibility to use sha256 or sha512 . ...
1
vote
1answer
525 views

What is meant by “KDF2” vs “PBKDF2”?

I see many references to KDF2 here, but all links are broken and Wikipedia does not have an entry for KDF2. Is KDF2 a specific standard for Key Derivation without a password? Ultimately, I am trying ...
1
vote
1answer
35 views

how can I draw from a set of characters using a seed for entropy?

Given a seed string S, I want to deterministically generate a password of the form: N characters, each chosen from a set of characters C Unfortunately neither N nor the cardinality of C necessarily ...
4
votes
2answers
1k views

Is SHA 2 suitable for key derivation?

Let's imagine that I've got a number modulo n given by DH protocol. I want to use it as a key for AES encryption. So I have to cut this number to fit it in AES (...
5
votes
2answers
1k views

Derive a secret from an RSA private key

What I want to do is deterministically derive a secure key from an RSA private key, such that the RSA private key cannot be derived from the secure key. The first approach that came to mind was ...
1
vote
1answer
947 views

Questions about the argon2 options

So because I am currently working on a Project in which I will use Argon2 I need some answers to questions about the options of Argon2. I didn't find anything about them. What exactly does the ...
1
vote
1answer
270 views

What is the key derivation function used in GnuPG, and how long may its input be?

I am currently working with GnuPG on a new project of mine. It would be very useful to know two things for that, which are not described in the manual: What is the maximum input size of a symmetric ...
4
votes
2answers
665 views

What exactly does s2k do in gpg

So I recently discovered the --s2k mode in gpg. Sadly it is not very well-documented. I mean, what is ...
14
votes
0answers
450 views

Memory-hard password hash in practice?

Dan Boneh, Henry Corrigan-Gibbs, and Stuart Schechter have proposed Balloon Hashing: A Memory-Hard Function Providing Provable Protection Against Sequential Attacks (in proceedings of AsiaCrypt 2016). ...
2
votes
2answers
518 views

For encryption with a passphrase, should you re-use the same salt for key generation?

Let's say I have a simple "vault" application where users can enter data and a passphrase, and it will be encrypted, requiring them to re-enter the passphrase to decrypt it. This would be implemented ...
3
votes
1answer
86 views

Is there a KDF that can be computed in an untrusted environment?

I'm looking for a Key Derivation Function, kind of like PBKDF2 or Scrypt, but which can be computed by a machine you don't trust. Some way to give it a derivative of the source password, such that ...
1
vote
1answer
91 views

Do PBKDF2 keys generated at a lower iteration count leak information?

Assume the threat model here is that the server is not to be trusted and the client is trusted. A user registers for an account and the client chooses an iteration count of 50,000 to generate a 512 ...
5
votes
2answers
3k views

Why are ephemeral/session/temporary keys useful?

One reason that communication protocols use ephemeral keys is to help with implementing Perfect Forward Security. They're also used in SSL to go from using RSA to using a faster symmetric encryption. ...
1
vote
1answer
141 views

Can key-wrapping help to securely change passphrase used to generate encryption key?

I am working on financial application where users' data are encrypted with symmetric cipher (AES-256), encryption keys is derived with KDF from user's password. I am looking for way how to give to my ...
0
votes
1answer
43 views

Formal Information-Theoretic Key Expansion Definition

Is there a formal definition for a protocol that expands keys that are pre-shared among 2 or more parties? How about an informal definition? Example: Alice and Bob pre-share a $n$-bit string $k$. ...
4
votes
3answers
574 views

Blake2B as a KDF

How would one go about using vanilla keyed Blake2B as a KDF with high-entropy inputs. Assume I don't have access to more specialized algorithms such blake2XB, HKDF, etc. Salt - high entropy per-...
4
votes
1answer
699 views

Argon2i versus Argon2d?

I am planning to use Argon2 in my Android app to encrypt some sensitive info that is only stored on the user's phone (in an SQLite DB) and not exported anywhere else. From documentation I see that ...
1
vote
1answer
627 views

Can a raw ECDH shared secret be used directly for encryption?

If two parties calculate an ECDH shared secret can they (with no security weakness) use this raw value directly as an encryption key, assuming the underlying key and ECDH sizes match? Also the ...
1
vote
1answer
111 views

FHMQV-C \sigma calculation - Full Dual Exponential Challenge Response (FDCR) signature schemes-

I'm studying the protocol FHMQV - C but I don't understand how two honest parties can reach the same value of $\sigma$. The paper that I'm studying is: https://eprint.iacr.org/2009/408.pdf. If you ...
0
votes
1answer
190 views

Cryptographic notation in X3DH Key Agreement Protocol

Can someone please explain the below paragraphs from section 2.2 in The X3DH Key Agreement Protocol? Please try to explain the whole paragraphs. 1st paragraph: I want to understand how the DH ...
-3
votes
1answer
155 views

Help in decrypting this message: “e811339cf0258d2977fdefcd110c0e17daa5de81”? [closed]

Here are some details: I was given was a text that was converted into hexadecimal, then hashed via MD5, then hashed via SHA-1. That’s all I know about it. Any help is really appreciated. There is ...
5
votes
1answer
833 views

Why does LastPass hash their passwords with PBKDF2 this way?

LastPass is a password manager that I am sure many of you are familiar with. I have been studying LastPass's source code a bit. From their FAQs and what I can gather from their source code, the way ...
3
votes
1answer
331 views

Sequential public key generation with secret private keys?

So this is an idea that popped into my head the other day and I wonder if there are any known crytographic schemes with these properties? Is there a way to construct a public / private key system in ...
0
votes
1answer
56 views

Restricting symmetric key usage

I have a system where some clients communicate with a server. every client has its own name and role and some other parameters that sends these info to the server in every message and the server uses ...
1
vote
1answer
231 views

Is there a recommendation or standard for using SCRYPT as an unbounded length KDF and not a fixed length authentication hash?

How would I go about this? I don't want to roll my own but I do really want to use SCRYPT as a KDF for several algorithms, some of which require an output length longer than the SHA-256 hash. ...
13
votes
2answers
681 views

Can any block cipher in CTR mode be used as a CSPRNG?

I have been learning about block ciphers, modes of operations, and csprngs by myself for a few days and there are some things I'm unsure about. Assuming we only talk about cryptographically secure ...
1
vote
2answers
107 views

Should I use independent symmetric keys for each client should I use keys derived from a master key?

I have several clients that I communicate with from a central location. All connections are encrypted using static symmetric keys that are hard-coded in each client config file. I use a different key ...
1
vote
1answer
377 views

Is key derivation of a token shared secret necessary for usage of token in TOTP as specified by RF6238?

TL;DR: Is it necessary to generate a 'random' key from a shared token secret string before putting it into a TOTP algorithm that follows the RFC 6238 specification? Or is it okay for me to put the ...
0
votes
0answers
86 views

How to handle operation containing large private key?

I am implementing Oblivious transfer protocol, for which I have to do the following operation? n = k0 ** d % n where d is a private key I am using ...
6
votes
1answer
185 views

Key derivation after ECDH: why h(q ‖ pk1 ‖ pk2)?

I want to use the X25519 DH key agreement for generating a single AES-128 key. The distribution of the shared secret of such a key agreement is not uniform, so it shouldn't be used directly. The ...
1
vote
0answers
34 views

Shall I use individual or common signing keys for different roles?

I have a server S to which a client system can establish connections using predefined roles R1, R2, ...Rn. For mutal exchange of data and for authentication with GCM/GMAC a set of symmetric AES-128 ...
8
votes
1answer
213 views

Is a key ratchet effective against replay attacks?

In the answer to this question, a message counter is used to protect against replay attacks. Could a key ratchet be used instead? The basic idea is that with every message sent, the symmetric ...
2
votes
1answer
786 views

SHA-256 support for SecretKeyFactory in Java 6 and 7?

According to the following linked Java documentation, the relevant option for SecretKeyFactory algorithm (ignoring deprecated options involving MD5 or DES etc.) running in JRE 6 and JRE 7 is: ...
0
votes
1answer
141 views

Does mixing two derived keys make a stronger key? And if so, how would I mix?

I have to generated a secure key from some meta data and a password, and I'm free to choose among a dozen of key derivation functions (KDFs). The problem is, I'm not too happy with either one. Some ...
0
votes
1answer
69 views

Are there any downsides to key stretching an already high quality entropic key?

For example, if we grab 50 bytes from a high quality source and run them through a key stretching function like Argon2 and have it generate a 32 byte secret for AES. Is there any downside to this? Do ...
1
vote
2answers
99 views

P2P encryption - Do I need a different session key each time?

I am using AES128-CBC+HMAC for all encryption. Currently I am using the same encryption and authentication/MAC key (Both derived from a master key with HKDF). Assuming that forward secrecy is not a ...
4
votes
3answers
320 views

Use of PBKDF2 when no access to HKDF?

I would like to use a unique encryption key and authKey for each payload that I encrypt and authenticate via AES256 CBC with HMAC-SHA256. I'm considering the following: ...
4
votes
0answers
100 views

Is it secure to cascade KDFs

I would like to know if the following process to generate keys for a set of devices is secure. Let’s say I have a 128-bit master key MK with high entropy. I use a KDF to generate a 128-bit device key ...
3
votes
1answer
70 views

Deriving user keys from ID

The "normal idea" is to generate a key per user, send them to the users (securely, of course), and store them in a database. But what if I use a keyed hash (like Blake2b) with a server key and then ...
6
votes
1answer
403 views

Derivation of many (Key, IV) pairs from random 128 nonces and one secret 512 master key

The ext4 encryption system encrypt files with aes-256-xts. Each file uses two unique keys which are derived from a 512 bit master key and a per-file 128 bit nonce randomly generated when the file is ...
7
votes
2answers
173 views

FIPS 202/SHAKE: insecure 3DES key derivation example

I'm trying to understand the following passage from FIPS 202 (the SHA-3 standard), discussing the SHAKE functions' correlated outputs for different output lengths and the risks they induce in some ...
4
votes
1answer
282 views

KDF vs Stream Cipher

I was wondering why someone would go and use HKDF (or any KDF) when they can use a stream cipher instead. It seems like a stream cipher will always be one-way, whereas a KDF might not be (see AES or ...
1
vote
1answer
428 views

Is this symmetric key MAC-then-encrypt auth token methodology secure?

NOTE: This question originally conflated a "digital signature" and a "MAC", which I've since learned are not the same thing. Any references (in the answer or any comments) to a "signature" should be ...
3
votes
2answers
610 views

How to properly AES encrypt a string, deriving the key from the same string?

Let's say someone has a list of names, e.g.: 'Batman' 'Batman' 'Super Man' I am auditing this list, but I'm not allowed full access to all names. So they must be ...