Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

85 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
11 votes
0 answers
2k views

Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information on its advantages against CBC ...
OughtToPrevail's user avatar
5 votes
0 answers
763 views

For TCG-Opal drives, which password is used to derive KEK?

SEDs use a user password (PIN) to generate KEK by a KDF algorithm. The KEK is then used to encrypt the MEK (where MEK is internally generated in the drive). But TCG-Opal drives have 9 locking-ranges ...
alonco's user avatar
  • 75
5 votes
0 answers
138 views

Upgrading key derivation by adding an XOR with a known value

In general, keys for password-based key derivation are derived from a password hash such as the old PBKDF2 function or Argon2, possibly followed by another derivation function to derive data and ...
Maarten Bodewes's user avatar
  • 92.3k
5 votes
0 answers
89 views

Is correlation in vector distributions "dangerous"?

Consider the two vector distributions $\xi,\chi$ described below, each one outputting integer vectors of length $n$ with coefficients in $\{0,\dots,n\}$. Distribution $\xi$ samples each coefficient $...
Tal-Botvinnik's user avatar
4 votes
1 answer
111 views

Robust CMAC-based key derivation function

I need to select a key derivation function that will likely be used in contexts that I haven't anticipated. It will run on very low-end devices (think potato-powered IoT sensor with a bulk cost of a ...
Gilles 'SO- stop being evil''s user avatar
4 votes
0 answers
193 views

ECIES: Purpose of optional shared information?

According to Wikipedia the ECIES algorithm has two optional shared information $S_1$ and $S_2$. They are used as follows: Generate a random shared secret $Z$ according to ECIES, which will never be ...
tryagain's user avatar
4 votes
0 answers
467 views

Storing password or derived key in keychain?

Currently I am developing an application that stores and reads encrypted data. The data is encrypted with AES and the actual AES key is derived from the users password (and some nonce) with PBKDF2 ...
Thekwasti's user avatar
  • 359
3 votes
0 answers
221 views

How does FileVault2 Recovery actually work?

I'm a crypto-enthusiast but no expert at all, that'll explain why i didn't understand. Also please consider english isn't my native language :) I am about to enable FileVault2 FDE on the new macbook ...
k1ngstr's user avatar
  • 31
2 votes
0 answers
81 views

Why does Argon2 truncate BLAKE2b outputs?

The Argon2 variable-length hash function uses BLAKE2b directly if the user requests an output less than or equal to 64 bytes in length. However, if the user requests an output longer than this, each ...
samuel-lucas6's user avatar
2 votes
0 answers
88 views

Why KeePassXC is deriving (stretching) the key again before saving changes to the database?

KeePassXC supports Argon2, which is great for security. However, there's a quirk that's been bothering me. Every time I save modifications to the database, it seems to stretch (derive) the key again, ...
Valentin Stoykov's user avatar
2 votes
0 answers
38 views

ZKP of knowledge of EC keys preimage

There is a random scalar seed $s$ which we may call a master secret. There are 2 public strings or scalars: $m1, m2$ and 2 corresponding EC keypairs: $a, A=a*G$ and $b, B=b*G$ $a$ and $b$ are somehow ...
John dow's user avatar
  • 149
2 votes
0 answers
58 views

Deriving multiple deterministic keys in a Schnorr Multisig setup

Let's say that Alice and Bob have generated truly random private keys $a$ and $b$ and want to use them in Schnorr signing. They calculate $X = g^a \cdot g^b$ as their mutual public key. For whatever ...
werki's user avatar
  • 21
2 votes
0 answers
68 views

Requirements for KDF and randomness extractor

What requirements KDF and randomness extractor does not have to meet, but the the hash function have to meet? I suspect that using hash functions as KDFs and randomness extractors is enough, but in ...
Tom's user avatar
  • 1,211
2 votes
0 answers
63 views

What is the key-derivation used in pdf2, is there a secure option?

I recently needed (for legitimate reasons) to crack an encrypted pdf sent by a local bank. It was pdf1.7 and the password was 6 digits. cracking it with John the ripper took no time at all. In fact it ...
Meir Maor's user avatar
  • 11.8k
2 votes
0 answers
66 views

How does the indexing in Argon2 work?

I am reading the original paper of Argon2 authors and I can understand the algorithm except the indexing part. Can anyone explain two things: the indexing process and the mapping $J_{1}$, $J_{2}$ to ...
Mathslover shah's user avatar
2 votes
0 answers
102 views

How hard is it to link a hardened BIP32 child public key to it's parent public key?

The BIP32 spec says this in the security section: ...
Shoaib Ahmed's user avatar
2 votes
0 answers
100 views

Derivable encryption key - BIP0032 parallel

I wish to find an asymmetric encryption algorithm that supports key derivation, BIP0032 style. Meaning that I have some SEED [PRIV] and I give someone some public data [PUB], then given new public ...
Danny Cohen's user avatar
2 votes
0 answers
103 views

Is my deniable encryption scheme reasonable?

I was experimenting with RubberhoseFS, but since it is very hard to compile on anything modern, I decided to implement my own version, stripped of many unnecessary features. Namely, my implementation ...
programagor's user avatar
2 votes
0 answers
153 views

Why would one split HKDF output into multiple parts instead of expanding it multiple times

Reading the implementation details of Signal's approach on double ratchet algorithm I noticed the following key derivation procedure for using AES-CBC with HMAC: HKDF is used (...) to generate 80 ...
Patrick's user avatar
  • 251
2 votes
0 answers
69 views

Use derived keying material as key for stream cipher

Section 7.3 of SP 800-108: To comply with this Recommendation, the derived keying material shall not be used as a key stream for a stream cipher. Footnote: The level of security provided by ...
Cyker's user avatar
  • 729
2 votes
0 answers
123 views

Key update and re-keying

What is the exact difference between the key update and re-keying? Following the discussions here, I understood that the key update is the process of deriving the new session key from old key. In the ...
amit 's user avatar
  • 77
2 votes
0 answers
723 views

Curve25519 / Ed25519 - Generate a private key from this term

I have 2 key pairs $(x_1, y_1)$, $(x_2, y_2)$. I also have $a = $random 256-bit array and $b = $256-bit of defined values from me. I know the values for $(x_1, y_1)$, $x_2$ and $b$. But I miss the ...
BuddyYuz's user avatar
2 votes
0 answers
166 views

Sharing salt for deterministic symmetric key derivation

I have a requirement to generate and share unique symmetric keys for a large numbers of small data objects. In many cases the storage and retrieval of the key for each object will be a significant ...
Neil's user avatar
  • 121
2 votes
0 answers
100 views

Can proofs be relayed to derived keys?

I am aiming to find out if this problem/puzzle can be solved with cryptography at all. Say there are these two parties: Subject S which has a master private/public key pair (MPriv, MPub) and a set of ...
Greendrake's user avatar
2 votes
0 answers
74 views

Did "The Catena Password-Scrambling Framework" make an error in the reduction of its pseudorandomness?

I was reviewing the most recent version of the Catena paper and they made some claims that I find questionable in their reduction of the pseudorandomness of the output of Catena (p. 32). First I will ...
user avatar
2 votes
0 answers
600 views

The right way to encrypt sensitive data with an user password

I am developing something like 1Password and I want to be sure that method that I use is secure. Main idea of the app is storing user passwords, and is protected with a global master password. Main ...
user avatar
2 votes
0 answers
432 views

Problems key AES 128 key from last round key

I have written an algorithm in Python to find the main AES 128 key from the last round key. However, it doesn't work; I can not find back my main key. I know that the general principle is to do $w[i] ...
tyuil's user avatar
  • 217
2 votes
0 answers
1k views

How do I generate decryption keys for the IDEA algorithm from the 128 bit key?

I am trying to implement IDEA algorithm in C#, just to learn how it works. I have taken a 128 bit binary key and generated the 52 encryption keys using the following code: ...
Nikhil Girraj's user avatar
2 votes
1 answer
345 views

CTR overlap with random IV

Problem: I'm slightly worried about counter repeats in CTR mode when using random IV. If you split it (like half IV, half counter), it increases chances of same IV (it is smaller) and limits message ...
LightBit's user avatar
  • 1,649
1 vote
0 answers
37 views

How to correctly use .NET's HKDF key derivation APIs to generate two keys for AES-256-CBC HMAC-SHA256 encryption

I have a 32-byte cryptographic key generated using .NET's cryptographic random number generator, and I'd like to use it as the key material to generate two other keys per user in my web application. ...
Anthony Simmon's user avatar
1 vote
0 answers
79 views

Two-party randomness for KEM

As indicated in an earlier Q / A, KEM's do not necessarily directly encrypt a pre-generated random value. However, it is clear that some KEM's do actually do this, with RSA-KEM being an obvious ...
Maarten Bodewes's user avatar
  • 92.3k
1 vote
0 answers
56 views

Linux Kernel CryptoAPI key exchange and key derivation

I have a custom network and I want to implement a symmetric key exchange and key derivation mechanism with ECDH. I know that I need to use KPP API and ECDH helper functions, but I can't find any code ...
Ham's user avatar
  • 11
1 vote
0 answers
67 views

Can deterministic wallet be seen as Key Derivation Function?

From Deterministic wallet: A deterministic wallet is a system of deriving keys from a single starting point known as a seed. From KDF from Wikipedia: In cryptography, a key derivation function (KDF)...
Finlay Weber's user avatar
1 vote
0 answers
177 views

How to compose (H)KDF, Encryption and (H)MAC

For legacy reasons one of my systems doesn't have the option of using an AEAD mode, we are restricted to AES in plain CBC or CTR mode plus a MAC. A typical task is to transfer data from one node to ...
eddydee123's user avatar
1 vote
0 answers
282 views

How secure is it to use a 128-bit random seed to derive a 256-bit key for seeding key-pair generation?

We are developing an open-source peer-to-peer app, Mapeo, designed for users with low technical experience (and no email or phone) to collect data in offline environments. We are generating their ...
Gregor's user avatar
  • 11
1 vote
0 answers
117 views

Memory-hard key derivation algorithm where all requested memory is needed at every time moment

Background. All MKDF (memory-hard KDF) algorithms that I know (Scrypt, Argon2, Balloon) don't really require all the memory at every moment during the run time of algorithm's implementation, but ...
caveman's user avatar
  • 573
1 vote
0 answers
161 views

Combining Post-Quantum and Classical KEM

I came across this paper "Hybrid Key Encapsulation Mechanisms", were three methods are defined that allow a secure combination of a classical key encapsulation with a post-quantum key ...
Marc's user avatar
  • 297
1 vote
0 answers
62 views

Can the hash of a PKCS1 v1.5 RSA signature be used as a key derivation function?

I know this sounds crazy, but hear me out. As a follow-up to Can the AES-GCM authentication tag be used as a key derivation function?, I'm also considering more creative solutions to derive unique (...
Perseids's user avatar
  • 562
1 vote
0 answers
92 views

How to handle IKEv1 and IKEv2 diffie-hellman shared secret bits length not multiple of 8?

In Cryptographic Algorithm Validation Program for KDF document, here, page 9, it says "If a field size that is not a multiple of 8 bits, the shared secret is represented by a string of bytes that ...
gx16's user avatar
  • 45
1 vote
0 answers
534 views

KDF options for a ECDH shared secret

the answer to this question suggests that the x-coordinate of an ECDH shared secret is itself usable as an encryption key without apply a KDF.... if so, then what additional security is provided by ...
biosbob's user avatar
  • 23
1 vote
0 answers
105 views

aeskeygenassist with only one imm8

I'm analyzing a binary which for its AES encryption, its only calling aeskeygenassist once and for the last argument (imm8, the ...
pobam62's user avatar
  • 11
1 vote
0 answers
84 views

Key derivation scheme with shared secrets?

I want to derive a list of sub-keys derived[t] from a master key mk by a key derivation function ...
h4x3rotab's user avatar
  • 111
1 vote
0 answers
212 views

I need to send 16 bytes using ECC keys on a resource-constrained device

I have a system where a resource-constrained device has to send 16 bytes. It has its ECC key pair, and a peer's Public ECC Key. We're using the p256 curve. The device also has an AES-128 hardware ...
Sarkreth's user avatar
  • 203
1 vote
0 answers
243 views

Strongswan KDF Test

How can a KDF implementation for IKEv2 application, specifically in strongswan implementation case can be verified for conformance with NIST SP800-135, please? SP800-135 KDF recommendation further ...
neutrino's user avatar
1 vote
0 answers
998 views

Which 'info' and 'salt' parameters to use in HKDF for TLS 1.3?

all the following discussion is for HKDF in TLS1.3: Regarding the 'salt' parameter in - HKDF-Extract(salt, IKM) as written in RFC 5869: HKDF without having to protect the secrecy of the salt. In a ...
Martin's user avatar
  • 165
1 vote
0 answers
132 views

Reason for including the public key of the key agreement in the KDF

I found the following text when looking up KDFs: In comparison, the so-called DHAES mode in IEEE 1363a mandates to use the binary representation of the sender’s public key as an input parameter. ...
Maarten Bodewes's user avatar
  • 92.3k
1 vote
0 answers
111 views

Is there hierarchical key generation that completely tolerates leakage?

Is there a hierarchical key construction algorithm that achieves forward/backward privacy with any (unlimited) leakage of private non-master keys? What I mean is that if there's an unbounded number ...
Some Guy's user avatar
  • 153
1 vote
0 answers
284 views

Securing MQTT communication

I am building kinda simple IoT project, but I would like to implement good security (just for educational purposes and fun). My plan is to build simple solution where one arduino board reads some data ...
user219863's user avatar
1 vote
0 answers
104 views

Question on inputs of PRFs and HKDF KDF

I've read a lot of information about PRNGs, PRFs and KDFs. As far as I know: PRNG: The seed for the PRNG must be a uniform string. It transforms a short real uniform string into some bits of pseudo-...
chris000r's user avatar
  • 519
1 vote
0 answers
104 views

Time-sensitive key derivation for sharing with third-party

Devices: In this system, users have one or more wearable devices (a smart watch), one of which they will most likely have on their person all the time. The devices are linked to their account by their ...
Touffy's user avatar
  • 111