Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

389 questions
49 views

Per-account iteration count for key derivation functions?

I'm working on an open protocol for the standardization of notes at my website “standardnotes.org”. Notes should be encrypted on the client device based on a key derived from the user's password. ...
455 views

Can someone clarify two things about the HKDF by Krawczyk?

I got a question about the HKDF Scheme by Hugo Krawczyk. On the following link you can find a small explanation of the HKDF-Scheme and some short informations. The HKDF specification itself has been ...
65 views

Special equivalent key in symmetric encryption

Let $k$ and $k'$ be two keys of symmetric encryption such that for some $m$ we have $Enc_k(m)=Enc_{k'}(m)$. Is it possible to exist a plain text $m'$ such that $Enc_k(m') \neq Enc_{k'}(m')$. In fact,...
273 views

How to securely combine multiple sources of entropy?

Suppose that I have $n$ secure 32-bit keys that were generated separately using methods that are known to be secure. For example, one of them might have been generated by using a proven CSPRNG. ...
940 views

Derive a key from a password and another key?

I would like to encrypt some data using a password. I want to use a function like PBKDF2 to turn my password into a key. However, I would like to also require a keyfile, for added security. My data ...
285 views

Very simple, very memory-hard (?) password-based key derivation

I know the problem of memory-hard password-based key derivation functions is better left to the likes of scrypt, argon2, etc... But validated implementations of those algorithims are not always ...
136 views

Cryptsetup | Given Enough Passphrase Entropy, Is It Necessary To Use a High Iteration Count?

Let's assume that, for creating a LUKS volume, I generate a random, 40 character passphrase that includes numbers, symbols, and upper and lower case letters, using the ...
6k views

Is there any benefit from using SHA-512 over SHA-256 when AES just truncates it anyway?

I am still not very clear on how AES-256-CBC can use SHA-512 bit keys, but I assume that it just truncates the 512bit hash down to 256bit. In software like GnuPG and OpenPGP, is there any real benefit ...
914 views

Is deriving the IV from the password secure?

I came across an encryption scheme to encrypt files with AES-256. You can see the initialization of the decryption routine below: ...
824 views

Difference between RFC-5869 (HKDF) and SP800-108 (Nist's HMAC-based KDF spec)?

I'm trying to find the difference between the two aforementioned algorithms. It seems that one is either a subset of the other. Could someone explain the similarities/differences?
75 views

How are round keys scheduled and generated in Crypto.Cipher.AES which is in Pycrypto library?

I'm just starting to learn to use PyCrypto. It would be really helpful for me to know how the round keys are scheduled and generated in the Crypto.Cipher.AES (in PyCrypto). Do they use any specific ...
162 views

What are the typical input lengths for KDFs?

I am looking for typical input lengths for key derivation functions like the HKDF. I know the parameters of HKDF, but can not find any information about typical input sizes to HKDF or any of the other ...
480 views

What is the difference between KDFs for key derivation vs password stretching?

This was mentioned in the comments to another question: To clarify: This is about key-stretching KDFs. Not the kind for diversifying keys (eg. HKDF) and There are two kinds of KDF, the slow, ...
59 views

Key Prefix KDF with Counter

I don't want to discuss the security problem with MD-based hashfunctions when using them as KDF. Since the existence of SHA3 or Skein hashfunction it is possible to use them as key prefix KDF. What I ...
53 views

Desirable Property of Block Sub-Keys

What is the more desirable for a block cipher's sub-keys ? Given two blocks ciphers, letting all other properties be equal (they have the same strength), the only difference between them is that: ...
92 views

122 views

Key management and derivation - Allow changing of the passphrase

I'm working on a program, which allows encrypting files before storing it on a cloud service. Currently I'm trying to figure out how to derive and store the keys. First, I wanted to use a simple ...
444 views

SHA256(RsaPrivateKey) == AES key?

I have an RSA private key (more specifically, an SSH key in Putty format, 4096bit) and want to use its SHA256 hash as an AES256 key, instead of using an independent newly generated AES key. Are ...
391 views

What is transaction capacity of a POS using 3DES DUKPT?

I am looking for the transaction capacity of a Point-Of-Sale device using 3DES DUKPT. Once all keys derived from the future key set are exhausted (1M or 500K?), how will the POS be reloaded with a new ...
697 views

Can I always derive a key pair from password+salt with libsodium?

I'm using libsodium to create public/secret key pairs from a password and salt combination by using crypto_pwhash_scryptsalsa208sha256 to generate a seed and ...
962 views

Deriving AES key and HMAC key from shorter master key

I am working in .NET and as far as I can tell the only choice for key derivation is PBKDF2-HMAC-SHA1. SHA1's output size is only 160 bits. But I am implementing authenticated encryption and thus ...
I have this equation, $E_{K_{as}}(E_{K_{bs}}(K_{ab}))$ which means $K_{ab}$ is encrypted by $K_{bs}$ then whole packet is encrypted by $K_{as}$. I think the key structure is $K_{as}$ is the master ...