We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
2
votes
1answer
212 views

Proof of shared secret through key derivation

Alice gives a random key $K$ (e.g. 32 bytes long) to Bob through a secure channel. Bob want to prove to Alice through an unsecured channel that he knows the key. Is it secure for Bob to send $s||KDF(...
4
votes
2answers
82 views

Entropy preservation through cryptographic hash function

Background First, while studying MinEntropy a bit, I came across an NIST paper, "DRAFT SP 800-90B (second draft)," which suggests "twice" the entropy of the underlying block of a cryptographic hash ...
2
votes
1answer
490 views

NIST SP800-108 KDF modes comparison

According to NIST SP800-108, there are three modes that can build KDF from PRF: counter mode, feedback mode and double-pipeline iteration mode. Assume that the same PRF and input distribution are used,...
0
votes
1answer
31 views

Securely derive AES and ED25519 keys from a ED25519 seed

Go's ed25519 package exposes a function which allows creating a private key from a 32 byte seed. See: https://godoc.org/golang.org/x/crypto/ed25519#NewKeyFromSeed The reason I want to use this is ...
2
votes
2answers
75 views

Optimal memory-hard KDF parameters when faced with small, slow memory

I am developing for a low-power embedded system. It has two ARM9 processors at 48 MHz each. One of the processors has access to 6 MiB of "fast" memory as well as access to 26 MiB of "slow" memory. The ...
2
votes
1answer
52 views

Is there more than one public key for a private key?

Does deriving the public key from an RSA private key always yield the same result? And if so, does this generally apply to all asymmetric cryptosystems?
1
vote
2answers
60 views

Split hash for 2 keys

These are the steps: Hash ECDH shared secret with SHA3-512 Concatenate odd bytes and rehash with SHA3-512 for AES-256 key Concatenate even bytes and rehash with SHA3-512 for KMAC key Is this key ...
1
vote
0answers
35 views

Key derivation scheme with shared secrets?

I want to derive a list of sub-keys derived[t] from a master key mk by a key derivation function ...
36
votes
1answer
25k views

Password hashing security of argon2 versus bcrypt/PBKDF2?

I wonder if it can be approximated how much of a security margin the new argon2 hash, winner of the password hashing competition, can give over bcrypt or PBKDF2, for an attacker using large GPU ...
5
votes
1answer
325 views

Are there any known problems or attacks for using SHA1(AES_key) as the HMAC key?

See this answer that explains the following sequence of operations: CipherText = IV|| AES(key1,iv,message) tag = hmac(key2,ciphertext) That answer says, You ...
1
vote
1answer
49 views

Station-to-Station protocol questions

Basic Station-to-Station protocol which authenticates Bob and Alice if they safely shared their long-term asymmetric public keys. Alice sends Bob her public key $A_K$ Bob receives $A_K$ and computes ...
1
vote
2answers
1k views

PHP AES-256 CBC faster than AES-128 CBC?

For the last couple of days, I have been learning a bit about encrypting data in PHP, as I need a good encryption/decryption function for storing users' passwords in a DB. I use ...
2
votes
2answers
149 views

Why cryptsetup default KDF is PBKDF2 and not Argon2(id)?

I plan to do a clean install of ArchLinux with Full Disk Encryption (with LUKS) but I'm not sure to understand the default KDF choice (PBKDF2+SHA-256). I didn't manage to find any pieces of evidence ...
1
vote
0answers
35 views

RSA Modulus doesn't match the primes [closed]

I generated a 2048-bit RSA key with ssh-keygen. When running: openssl rsa -in key -noout -text The result is: ...
9
votes
4answers
1k views

Which risks are associated with deriving multiple keys from the same DH secret Z?

NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment. NIST ...
0
votes
1answer
82 views

Security implications of using a high entropy password with a low iteration count for a key derivation function

This question is related to my other question, but also this entropy calculation question as well as this article about PBKDF2. It may also be considered as a duplicate of this question, although in ...
4
votes
2answers
124 views

Key derivation on Arduino

The ATmega2560 is slow - it's a single core, 16MHz 8-bit AVR. Despite that, I need to use some encryption on it, and since it is limited to a few blocks, AES-256 can be used. However, the key ...
0
votes
0answers
25 views

Rekeying procedure - how “far” from bijection?

Imagine that I want to change the key in order to prevent side-channel attacks on key and to protect against big load on the one key. It is desirable that key change procedure would look like random ...
2
votes
1answer
88 views

Are two keys derived from the same password vulnerable to a related key attack?

Background I am currently writing a password manager application. As usual, the passwords are put in a file encrypted using a user-entered password. I'm using the NaCl library but actually it's not ...
17
votes
2answers
2k views

Is bcrypt better than GnuPG's iterated+salted hashing method?

GnuPG has slow hash built-in in form of iterated+salted S2K. Does it have disadvantages in comparison with bcrypt or scrypt? Is GnuPG's slow hash method easily automated in GPUs?
7
votes
2answers
1k views

What exactly does s2k do in gpg

So I recently discovered the --s2k mode in gpg. Sadly it is not very well-documented. I mean, what is ...
4
votes
3answers
959 views

Should we run PBKDF2 for every plaintext to be protected or should we run PBKDF2 only once?

I am going to store secrets from users. The secrets need to be stored confidentially. For this question, I am concerned only with confidentiality (not integrity). Here is how my encryption scheme is: ...
11
votes
3answers
1k views

Is deriving the IV from the password secure?

I came across an encryption scheme to encrypt files with AES-256. You can see the initialization of the decryption routine below: ...
31
votes
6answers
4k views

What is the practical impact of using System.Random which is not cryptographically random?

I recently noticed a .NET software using PBKDF to derive an encryption key from a password string. This password string was ...
1
vote
1answer
66 views

Can you derive a 128 bit AES encryption key using PBKDF2 with SHA-256

I got confused about key derivation functions. For my project, I need to derive a 128 bits AES encryption key in CTR mode. To do so, I'm using a PBKDF2 to derive this encryption key using an initial ...
5
votes
1answer
471 views

Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?

PBKDF2 should only be used to generate a larger output than the hash function it uses if the output is used in such a way that it has a flat keyspace. As far as I am aware, XTS does not have a flat ...
0
votes
0answers
49 views

Are two halves of PBKDF output “related” [duplicate]

In other words, in the context of authenticated encryption using Encrypt-Then-MAC, is this stupid?: ...
2
votes
3answers
165 views

Use a SHA256 as a key for AES256

Is it safe to use the SHA256 of a hard-to-bruteforce string as the key to encrypt data with AES256?
2
votes
1answer
70 views

What is a randomly derived key?

It is a well-known fact that using the same key + nonce combination with a stream cipher twice breaks security. The NaCl library has different primitives for authenticated encryption (i.e., ...
2
votes
1answer
868 views

KDF based on X9.63 vs. NIST SP800-108

What is the difference between KDF based on NIST SP800-108 vs. the older one in ANSI X9.63? When should one be selected over the other? Thanks.
1
vote
2answers
71 views

“Dave Check” for a tweakable P-256 ECDH KDF

I have two devices with hardware tokens that contain P-256 private keys, and which allow me to compute ECDH shared secrets with arbitrary public keys. I need to build a tweakable key derivation ...
2
votes
1answer
59 views

Is it safe to reuse the salt for generating symmetric keys for a chat application?

I'm writing a program that allows two users to communicate over E2E encrypted chat with a secret they have agreed upon in the past. The process works as follows: A key is derived from the secret ...
4
votes
3answers
542 views

Generate 2 independent keys from a master key

The scenario is like this: I need 2 keys for different purposes (encryption + encryption, encryption + mac, or whatever). Because it is not good practice to reuse the same key, I'd like the 2 keys to ...
2
votes
1answer
42 views

AES key schedule. Does it use a KDF to generate the round keys?

So for each round in AES a different key is used, and as I saw the keys are created form a master key. My question is how these round keys are generated. Are they created via a Key Derivation ...
0
votes
0answers
28 views

ECDHE Key with KDF Necessary [duplicate]

Is it necessary to pass a ECDH generated key to a KDF? According to the python cryptography documentation, it is stated that For most applications the shared_key should be passed to a key ...
0
votes
0answers
58 views

Generating the Backup Exec AES-256 GCM key used to encrypt/decrypt LTO5 tape drive data

I've got an LTO5 tape that was backed up using Backup Exec (BE), which used hardware compression when writing to the tape. I've been given the passphrase that BE used to create the actual encryption ...
1
vote
0answers
58 views

I need to send 16 bytes using ECC keys on a resource-constrained device

I have a system where a resource-constrained device has to send 16 bytes. It has its ECC key pair, and a peer's Public ECC Key. We're using the p256 curve. The device also has an AES-128 hardware ...
13
votes
3answers
6k views

How many KDF rounds for an SSH key?

What is the best practice on choosing how many key derivation function (KDF) rounds/iterations when generating an SSH key pair with ssh-keygen? Am I correct in saying that it is unnecessary if the ...
0
votes
0answers
18 views

Off-Chain Channel With Multi Participants That Have Different View/Write Access

I'm looking to expand my blockchain ability to have off-chain channels between different participants (let's say more than 2 participants). The requirements: Only the participants of the channel ...
3
votes
1answer
70 views

Bluetooth Low Energy: Key generation

I'm studying the BT core spec v5.1 to understand the security features and how everything fits together. I am looking at Secure Connections for now. In the field "Key generation" it says it uses P-...
1
vote
2answers
49 views

Derive operations from an arbitrary number

I don't really know how to phrase this question, so I'll just mention the idea. This is partially reminiscent (at least in spirit to white box crypto): Can one derive arithmetic operations from a ...
1
vote
1answer
49 views

how are variable key sizes produced?

I am current learning the internal working of several Symmetric key Cryptographic algorithms, and came across DES and AES. DES takes in input a 64 bit key and AES-128 takes in input a 128 bit key ...
0
votes
0answers
57 views

Can I use XOR to establish a longer shared secret?

SIKEp434 can only be used to encapsulate a 16 byte (128 bit) shared secret key. Most encryption algorithms these days (specifically (X)ChaCha20) require a 256 bit key to be secure, especially in a ...
6
votes
2answers
252 views

Do you really need a KDF when you have a PRF?

My understanding is that a KDF is like a PRF, except that it has a preliminary step that "extract" entropy. It is thus needed when the entropy is non-uniform (for example the output of ECDH is modulo ...
3
votes
2answers
144 views

Hashing a hash for authentication

I currently use Argon2 to derive a key (I will use a salt which I will save in a file as plaintext for when I later need to derive a key again) from a given password which I will use to encrypt a file ...
0
votes
0answers
28 views

Key Value Based Key Derivation

For a system that is using public key cryptography to authenticate users and their actions I'm trying to solve (ease) UI/UX problem so that users will be able to use login/passwords they're accustomed ...
5
votes
2answers
4k views

Looking at hash output – is Base64 encoding in any way better than HEX encoding?

I was wondering why most "normal/unsafe" crypto hashes like SHA-256, SHA-512, Whirlpool, RipeMD-160, MD5, etc. are HEX encoded. But most "secure" crypto hashes (KDF' ) like ...
3
votes
4answers
2k views

Why is Bcrypt called a Key Derivation Function?

I am trying to understand why is bcrypt called a Key Derivation Function? I looked up the details of Ekfblowfish on Usenix article. After reading it, I understood that: The password is the ...
2
votes
2answers
413 views

Key Derivation Functions vs. Password Hashing Schemes

Key derivation functions, such as HKDF (standardized in RFC 5869), are meant to stretch some initial keying material having enough entropy, like a Diffie-Hellman shared value, into one or more strong ...
1
vote
0answers
814 views

DUKPT MAC Variant key [closed]

I'm currently implementing an interface that makes use of the DUKPT (Derived Unique Key Per Transaction) scheme to generate MAC keys. This particular interface uses a different (variant) of the MAC ...