Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

2
votes
1answer
47 views

For two LUKS volumes made with the same password, can stealing the encryption key from one volume allow access to the other?

A running computer has two LUKS volumes that were made with the same password. One volume is open (key is in RAM), the other is closed. If the running computer is stolen, is the closed volume safe? ...
2
votes
1answer
63 views

How to encrypt sensitive files in a business application? Is it needed?

I'm currently working on a business Java application, and we store sensitive files related to our users. What is the appropriate approach to store them securely? Is it viable to encrypt/decrypt all ...
14
votes
0answers
445 views

Memory-hard password hash in practice?

Dan Boneh, Henry Corrigan-Gibbs, and Stuart Schechter have proposed Balloon Hashing: A Memory-Hard Function Providing Provable Protection Against Sequential Attacks (in proceedings of AsiaCrypt 2016). ...
5
votes
0answers
82 views

Is correlation in vector distributions “dangerous”?

Consider the two vector distributions $\xi,\chi$ described below, each one outputting integer vectors of length $n$ with coefficients in $\{0,\dots,n\}$. Distribution $\xi$ samples each coefficient $...
4
votes
0answers
57 views

Upgrading key derivation by adding a XOR with a known value

In general keys for password based key derivation are derived from a password hash such as the old PBKDF2 function or Argon2, possibly followed by another derivation function to derive data and ...
4
votes
0answers
307 views

Use RSA keys to derive AES key

I have 2 end points where I would like to derive the same AES key. Every end point has its own RSA key pair and RSA public key from the other end point, and I would like to combine them somehow on ...
4
votes
0answers
100 views

Is it secure to cascade KDFs

I would like to know if the following process to generate keys for a set of devices is secure. Let’s say I have a 128-bit master key MK with high entropy. I use a KDF to generate a 128-bit device key ...
4
votes
0answers
325 views

Storing password or derived key in keychain?

Currently I am developing an application that stores and reads encrypted data. The data is encrypted with AES and the actual AES key is derived from the users password (and some nonce) with PBKDF2 ...
3
votes
0answers
55 views

Did “The Catena Password-Scrambling Framework” make an error in the reduction of its pseudorandomness?

I was reviewing the most recent version of the Catena paper and they made some claims that I find questionable in their reduction of the pseudorandomness of the output of Catena (p. 32). First I will ...
3
votes
0answers
125 views

ECIES: Purpose of optional shared information?

According to Wikipedia the ECIES algorithm has two optional shared information $S_1$ and $S_2$. They are used as follows: Generate a random shared secret $Z$ according to ECIES, which will never be ...
2
votes
0answers
46 views

Derivable encryption key - BIP0032 parallel

I wish to find an asymmetric encryption algorithm that supports key derivation, BIP0032 style. Meaning that I have some SEED [PRIV] and I give someone some public data [PUB], then given new public ...
2
votes
0answers
70 views

Is my deniable encryption scheme reasonable?

I was experimenting with RubberhoseFS, but since it is very hard to compile on anything modern, I decided to implement my own version, stripped of many unnecessary features. Namely, my implementation ...
2
votes
0answers
22 views

Use derived keying material as key for stream cipher

Section 7.3 of SP 800-108: To comply with this Recommendation, the derived keying material shall not be used as a key stream for a stream cipher. Footnote: The level of security provided by ...
2
votes
0answers
41 views

Key update and re-keying

What is the exact difference between the key update and re-keying? Following the discussions here, I understood that the key update is the process of deriving the new session key from old key. In the ...
2
votes
0answers
302 views

Curve25519 / Ed25519 - Generate a private key from this term

I have 2 key pairs $(x_1, y_1)$, $(x_2, y_2)$. I also have $a = $random 256-bit array and $b = $256-bit of defined values from me. I know the values for $(x_1, y_1)$, $x_2$ and $b$. But I miss the ...
2
votes
0answers
56 views

Sharing salt for deterministic symmetric key derivation

I have a requirement to generate and share unique symmetric keys for a large numbers of small data objects. In many cases the storage and retrieval of the key for each object will be a significant ...
2
votes
0answers
80 views

Can proofs be relayed to derived keys?

I am aiming to find out if this problem/puzzle can be solved with cryptography at all. Say there are these two parties: Subject S which has a master private/public key pair (MPriv, MPub) and a set of ...
2
votes
0answers
185 views

The right way to encrypt sensitive data with an user password

I am developing something like 1Password and I want to be sure that method that I use is secure. Main idea of the app is storing user passwords, and is protected with a global master password. Main ...
2
votes
0answers
364 views

Bitwise method of generating r for RSA-KEM

It seems that RSA-KEM has a very troublesome method of generating the secret $r$. It seems that the random value needs to be in the range $0 \le r \le {n - 1}$. Now most cryptographic environments ...
2
votes
0answers
136 views

How does FileVault2 Recovery actually work?

I'm a crypto-enthusiast but no expert at all, that'll explain why i didn't understand. Also please consider english isn't my native language :) I am about to enable FileVault2 FDE on the new macbook ...
1
vote
0answers
34 views

Why would one split HKDF output into multiple parts instead of expanding it multiple times

Reading the implementation details of Signal's approach on double ratchet algorithm I noticed the following key derivation procedure for using AES-CBC with HMAC: HKDF is used (...) to generate 80 ...
1
vote
0answers
36 views

Is there hierarchical key generation that completely tolerates leakage?

Is there a hierarchical key construction algorithm that achieves forward/backward privacy with any (unlimited) leakage of private non-master keys? What I mean is that if there's an unbounded number ...
1
vote
0answers
67 views

Securing MQTT communication

I am building kinda simple IoT project, but I would like to implement good security (just for educational purposes and fun). My plan is to build simple solution where one arduino board reads some data ...
1
vote
0answers
32 views

Question on inputs of PRFs and HKDF KDF

I've read a lot of information about PRNGs, PRFs and KDFs. As far as I know: PRNG: The seed for the PRNG must be a uniform string. It transforms a short real uniform string into some bits of pseudo-...
1
vote
0answers
29 views

Time-sensitive key derivation for sharing with third-party

Devices: In this system, users have one or more wearable devices (a smart watch), one of which they will most likely have on their person all the time. The devices are linked to their account by their ...
1
vote
0answers
106 views

HKDF to derive multiple keys from a strong constant master secret and a weaker changing secret

I am working with constrained nodes (type OpenMote CC2538) on a (constrained) 6TiSCH network and I am trying to design a good re-keying scheme designed to generate AES-128 keys dubbed Device ...
1
vote
0answers
129 views

Problems key AES 128 key from last round key

I have written an algorithm in Python to find the main AES 128 key from the last round key. However, it doesn't work; I can not find back my main key. I know that the general principle is to do $w[i] ...
1
vote
0answers
227 views

Can I use a random number generator with seed for key derivation?

I don't know a thing about cryptography so I'm judging by what I see in APIs docs. I want to use ECDSA or ECDH in my project. And what I know so far about key derivation in this systems is that they: ...
1
vote
0answers
34 views

Shall I use individual or common signing keys for different roles?

I have a server S to which a client system can establish connections using predefined roles R1, R2, ...Rn. For mutal exchange of data and for authentication with GCM/GMAC a set of symmetric AES-128 ...
1
vote
0answers
1k views

What is the use of key iterations?

I read about PBKDF2 on Wikipedia and seen few apps. having option to manually enter number of iterations. I am still not clear on this. (1) With what I understood, key iterations can be used only ...
1
vote
0answers
41 views

Using multiple iterations of Argon2i

Consider Argon2i used as a key derivation function (implemented by the libsodium crypto library) to derive an encryption key from a password. Additionally, when entering the password a second time, ...
1
vote
0answers
56 views

Password manager that uses a mix of long and short key derivation functions

I was reading "A Convenient Method for Securely Managing Passwords, Halderman et al., 2005". In short, the authors say to do the following: ...
1
vote
0answers
339 views

NIST SP800-108 KDF modes comparison

According to NIST SP800-108, there are three modes that can build KDF from PRF: counter mode, feedback mode and double-pipeline iteration mode. Assume that the same PRF and input distribution are used,...
1
vote
0answers
185 views

Need help with PKCS#12 3 key triple des key expansion

I am trying to decrypt PKCS8-Shrouded Key Bag inside a PKCS#12 pfx file. The oid for the encrypted data is PbeWithSHAAnd3-KeyTripleDES CBC. Iteration count and salt has been provided within the pfx ...
1
vote
0answers
273 views

ECDH security when no KDF is used

Let's suppose our device performs ECDH with a fixed, unknown, private key $prv$. It accepts as input any point $Q$ lying in the proper subgroup of the proper ellipict curve, then computes: $P = prv*Q$...
1
vote
0answers
94 views

Hardening of random number generators

Boxcryptor uses various CSPRNGs and apparently hashes the output using PBKDF2 to derive the final key. Even though the choice of ...
1
vote
0answers
1k views

How do I generate decryption keys for the IDEA algorithm from the 128 bit key?

I am trying to implement IDEA algorithm in C#, just to learn how it works. I have taken a 128 bit binary key and generated the 52 encryption keys using the following code: ...
0
votes
0answers
58 views

Using OpenSSL to emulate LTO 4 tape encryption

I have a mix of LTO 4 and LTO 3 tapes I would like to encrypt data on to. LTO 4 has built in encryption - load they key into the drive, and it handles the AES-256-GCM encyption transparently. LTO 3 ...
0
votes
0answers
106 views

Is it more secure to derive a symmetric key with a timestamp?

I see a lot about derived keys for signing messages, but not for encrypting messages. AWS's SigV4, for example, includes the timestamp when deriving the signing key. Would it make sense to use public ...
0
votes
0answers
105 views

Derivative of a symmetric encryption key

Let generate a master symmetric key mSk We encrypt a file F using mSk; and upload it in a ...
0
votes
0answers
127 views

3 way key derivation

We have a master key which we would like to protect. We want to derive keys for two sets of clients in such a way that client set 1 and client set 2 can mutually authenticate each other. If client set ...
0
votes
0answers
85 views

How to handle operation containing large private key?

I am implementing Oblivious transfer protocol, for which I have to do the following operation? n = k0 ** d % n where d is a private key I am using ...
0
votes
0answers
49 views

Per-account iteration count for key derivation functions?

I'm working on an open protocol for the standardization of notes at my website “standardnotes.org”. Notes should be encrypted on the client device based on a key derived from the user's password. ...
0
votes
0answers
75 views

How are round keys scheduled and generated in Crypto.Cipher.AES which is in Pycrypto library?

I'm just starting to learn to use PyCrypto. It would be really helpful for me to know how the round keys are scheduled and generated in the Crypto.Cipher.AES (in PyCrypto). Do they use any specific ...
0
votes
0answers
136 views

key hierarchy management and master key

I have this equation, $E_{K_{as}}(E_{K_{bs}}(K_{ab}))$ which means $K_{ab}$ is encrypted by $K_{bs}$ then whole packet is encrypted by $K_{as}$. I think the key structure is $K_{as}$ is the master ...
0
votes
0answers
95 views

How to derive a key from an existing AES key?

Currently, the code I am staring at uses the CKM_EXTRACT_KEY_FROM_KEY mechanism. That has been disabled in our hardware module, so I need a different mechanism to ...