Questions tagged [key-derivation]
In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.
126
questions
7
votes
1
answer
4k
views
Multiple AES Key Derivation from a master key
I need cryptography advice regarding this issue.
Kamus is a service that encrypts secrets for applications running on Kubernetes. When using AES (actually, Rijndael) symmetric encryption, Kamus uses ...
16
votes
1
answer
5k
views
Security of KDF1 and KDF2 (hash based KDF's)
It's still common to come across implementations of KDF1 and KDF2. Basically these are KDF's that simply derive multiple keys from the key seed and a counter:
$K_i = \operatorname{KDF}(K_{master}, i) ...
- 93.9k
4
votes
2
answers
2k
views
Mathematical formula for switching the key for OTP?
Instead of generating the random key for the one time pad cipher over and over again, is there a mathematical formula that allows you to switch the key to a new key? The new key must be as random and ...
- 89
7
votes
3
answers
3k
views
Formal description of KDF1 and KDF2
I've seen many descriptions of KDF1 and KDF2 by now, but most documents simply point to specifications that are behind a pay wall. These standards are not specific to the KDF's; they just use these ...
- 93.9k
11
votes
1
answer
2k
views
How random is the shared secret in the Diffie Hellman key agreement
How random is the value $ZZ$ in the DH protocol?
This question was triggered by this somewhat naïve implementation in I2P shown by Sergei at Stackoverflow. Obviously $ZZ$ is distinguishable from a ...
- 93.9k
38
votes
4
answers
35k
views
How can one securely generate an asymmetric key pair from a short passphrase?
Background info:
I am planning on making a filehost with which one can encrypt and upload files. To protect the data against any form of hacking, I'd like not to know the encryption key ($K$) used for ...
- 485
22
votes
2
answers
8k
views
Deriving Keys for Symmetric Encryption and Authentication
So here's the concept. Rather than storing 2 keys and using a random IV, which presents its own problems (key rotation, ensuring no key is used in more than 2^32 cycles, sharing the keys, etc), is it ...
- 425
11
votes
4
answers
2k
views
Which risks are associated with deriving multiple keys from the same DH secret Z?
NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment.
NIST states ...
11
votes
1
answer
3k
views
How to salt PBKDF2, when generating both an AES key and a HMAC key for Encrypt then MAC?
When using Encrypt-then-MAC with AES and HMAC by password, and given 128 bits of payload with the ciphertext to store a random salt, which would be more secure:
Using PBKDF2 with then entire 128 bit ...
- 278
5
votes
1
answer
2k
views
ECDH security when no KDF is used
Let's suppose our device performs ECDH with a fixed, unknown, private key $\text{prv}$.
It accepts as input any point $Q$ lying in the proper subgroup of the proper elliptic curve, then computes: $P =...
- 7,144
32
votes
2
answers
39k
views
Key derivation functions (KDF): What are they, what are their main purposes and how they can be used?
What are KDFs? What are their main purposes? How they can be used, in other words, what's their drill in a cryptography scheme?
- 485
9
votes
2
answers
5k
views
Key Derivation Functions vs. Password Hashing Schemes
Key derivation functions, such as HKDF (standardized in RFC 5869), are meant to stretch some initial keying material having enough entropy, like a Diffie-Hellman shared value, into one or more strong ...
- 1,205
7
votes
1
answer
2k
views
Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?
PBKDF2 should only be used to generate a larger output than the hash function it uses if the output is used in such a way that it has a flat keyspace. As far as I am aware, XTS does not have a flat ...
- 15.4k
4
votes
1
answer
9k
views
DES Key Schedule Algorithm
Reading through the DES Specification it says that the keys are permuted with PC-1 initially and then shifted left both $C$ and $D$. However, before it gets ...
- 143
21
votes
6
answers
2k
views
Why does PBKDF2 xor the iterations of the hash function together?
The definition of PBKDF2 states that I obtain a derived key (1) by calling a pseudorandom function a bunch of times recursively:
$U_1 = PRF(password, salt)$
$U_2 = PRF(password, U_1)$
…
$U_n = PRF(...
- 313
20
votes
2
answers
11k
views
Deterministically generate a RSA public/private key pair from a passphrase (with sufficient entropy)?
Is it possible to deterministically generate public/private RSA key pairs from passphrases?
Would giving the (key generating) algorithm data made from key-stretching the passphrase (instead of a ...
- 958
19
votes
0
answers
3k
views
What's the difference between a Key Derivation Function and a Password-Hash? [duplicate]
It seems to me that anything that was sufficiently good as a KDF would work just fine as a password hash, though the reverse might not be true. Are there considerations specific to password-hashing ...
- 373
24
votes
6
answers
49k
views
PBKDF2 and salt
I want to ask some questions about the PBKDF2 function and generally about the password-based derivation functions.
Actually we use the derivation function together with the salt to provide ...
- 341
14
votes
3
answers
4k
views
PBKDF2 for key diversification
I am looking for a secure key diversification function to create individual AES keys for a local smart card deployment. The keys need to be derived from a secret master key and the smart card serial ...
- 243
14
votes
2
answers
2k
views
Can any MAC be used as a KDF?
First, let me clarify what I mean with a Key Derivation Function (KDF). I'm interested in KDFs that take an $n$-bit symmetric master key and some diversification data of arbitrary length as input and ...
- 243
9
votes
1
answer
2k
views
Is the AES Key Schedule weak?
After reading this paper entitled Key Recovery Attacks of Practical Complexity on AES Variants With Up To 10 Rounds, I was left wondering why AES's key schedule is invertible.
In the paper, the ...
user1449
9
votes
2
answers
2k
views
Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?
I have a following use case:
User has his master public (pk) - private (sk) key pair (Ed25519).
In DB we store a public key.
Is ...
- 283
5
votes
1
answer
3k
views
Is a PBKDF2-derived master key easier cracked if very many Data Protection Keys are derived from it?
I'm referring the NIST document about PBKDF2, NIST Special Publication 800-132, Recommendation for Password-Based Key Derivation,
Part 1: Storage Applications, Page 8 and 9, section 5.4 Using the ...
- 195
3
votes
1
answer
664
views
Is it safe to split the output of PBKDF2?
I would like to know if splitting a key generated by PBKDF2 to derive two keys is a safe practice.
Concretely, in my system, I need to derive two keys. One for symmetric cipher used in the client ...
- 177
3
votes
1
answer
3k
views
HKDF: ikm, salt and info values
As indicated at
Key generation for AES-GCM-256 file encryption
I'm currently working on a file encryption software. In the above thread it was suggested that, for performance reasons, I use a ...
- 71
54
votes
1
answer
44k
views
Password hashing security of argon2 versus bcrypt/PBKDF2?
I wonder if it can be approximated how much of a security margin the new argon2 hash, winner of the password hashing competition, can give over bcrypt or PBKDF2, for an attacker using large GPU ...
- 751
29
votes
4
answers
7k
views
Is there a hash function that's more expensive for an attacker than for the server?
Say a server wants to hash a password $p$. It would use a secure hash function $H$ and a unique salt $s$ to hash the password as $H(p,s)$. If one has access to the salt, each password candidate ...
- 862
25
votes
2
answers
18k
views
What is the difference between Scrypt and PBKDF2?
After reading these two resources I am wondering am I getting all the differences between Scrypt and PBKDF2.
As far as I understood, the similarity is:
both are password-based key derivation ...
- 365
17
votes
2
answers
2k
views
Is bcrypt better than GnuPG's iterated+salted hashing method?
GnuPG has slow hash built-in in form of iterated+salted S2K.
Does it have disadvantages in comparison with bcrypt or scrypt? Is GnuPG's slow hash method easily automated in GPUs?
- 369
11
votes
2
answers
8k
views
How to derive a symmetric key from ECDH shared secret?
I am trying to implement the internal primitives of ECDH. Currently I'm able to multiply the receiver's public EC point with the sender's private key to arrive at the shared EC point. Next step is to ...
- 267
8
votes
2
answers
5k
views
What exactly does s2k do in gpg
So I recently discovered the --s2k mode in gpg.
Sadly it is not very well-documented. I mean, what is ...
- 4,485
8
votes
2
answers
12k
views
What are KDF parameters in OpenSSL command-line utility for `enc`?
I refer to https://www.openssl.org/docs/manmaster/apps/enc.html and see that the only parameter for key derivation which I can set explicitly (not considering the obvious ...
- 83
7
votes
2
answers
7k
views
How secure is it to use password as AES key?
I am developing a steganography app where user encrypt any file into an audio file. The user can enter a password to protect the hidden data. The same password is converted as a 256 bit key and the ...
- 71
7
votes
1
answer
3k
views
What information to include is the 'info' input for HKDF?
The RFC states the following:
3.2. The 'info' Input to HKDF
While the 'info' value is optional in the definition of HKDF, it is often of great importance in applications. Its main objective is to ...
- 3,987
7
votes
2
answers
873
views
Entropy preservation through cryptographic hash function
Background
First, while studying MinEntropy a bit, I came across an NIST paper, "DRAFT SP 800-90B (second draft)," which suggests "twice" the entropy of the underlying block of a cryptographic hash ...
- 187
6
votes
1
answer
3k
views
Can a raw ECDH shared secret be used directly for encryption?
If two parties calculate an ECDH shared secret can they (with no security weakness) use this raw value directly as an encryption key, assuming the underlying key and ECDH sizes match?
Also the ...
6
votes
1
answer
1k
views
Computing IV for CBC from PBKDF2 + HKDF
Note that this question is somewhat similar to Can I use my random IV (for AES) as a salt for PBKDF2?
My current encryption format computes two random PBKDF2 salts (encryption and HMAC, 8 bytes each) ...
- 669
5
votes
3
answers
2k
views
Generate 2 independent keys from a master key
The scenario is like this: I need 2 keys for different purposes (encryption + encryption, encryption + mac, or whatever). Because it is not good practice to reuse the same key, I'd like the 2 keys to ...
- 739
4
votes
1
answer
4k
views
RSA key pair generation using PRNG with same seed
I see a lot of Q/A where persons are trying to generate a specific key pair using static data such as a password. Now say we use a known PRNG (dangerous assumption), seeded with a the data as a static ...
- 93.9k
4
votes
1
answer
4k
views
Clarification needed in TLS 1.2 key derivation process
Reference to TLS 1.2 standard documentation section 6.3 regarding the key generation here:
To generate the key material, compute
...
- 503
3
votes
1
answer
560
views
Bitwise method of generating r for RSA-KEM
It seems that RSA-KEM has a very troublesome method of generating the secret $r$. It seems that the random value needs to be in the range $0 \le r \le {n - 1}$.
Now most cryptographic environments ...
- 93.9k
3
votes
1
answer
200
views
Why does using keyed-$PRF$-derived inputs in a (non-committing) $\texttt{nc-AEAD}$ not provide commitment?
A definition for committing security in authenticated encryption can be described in relation to a security parameter $\lambda_{com}$, where the per-guess probability of finding distinct input tuples
$...
- 1,116
3
votes
3
answers
575
views
Memory hard key derivation (password hash) using AES encryption
I am restricted on a certain environment involving PHP and am currently unable to implement new memory hard hashes such as scrypt (and I am not trying to compete with the likes of scrypt).
My ...
- 751
3
votes
3
answers
1k
views
Can I dynamically calculate an appropriate number of iterations for PBKDF2 based on the system time, rather than using a fixed value?
Could you choose the number of PBKDF2 iterations based upon the system time?
I've heard a few people recommend that the number of iterations for PBKDF2 should be doubled every two years (starting with ...
- 133
3
votes
3
answers
912
views
Entropy of system data - use all and hash, or trim least significant bits?
I'm working on a background entropy collector for key generation that monitors hardware and produces an entropy pool.
Here's my list of sources:
Mouse position
Keyboard timings (i.e. time between ...
- 3,547
3
votes
1
answer
2k
views
Encryption and HMAC key derivation
I'm deriving keys from a user-supplied passphrase for symmetric encryption using AES-256 in CBC mode with a HMAC for authenticity/integrity.
My key derivation function currently looks like this:
...
- 987
2
votes
1
answer
578
views
Key Derivation Function (KDF): Can a key derived from KDF be considered as a secure key?
Consider a case where we have a master key MS that is used in pseudo-random function to generate a set of pseudo-random values. Then we use key derivation function to derive a key from each of pseudo-...
- 1,583
2
votes
3
answers
514
views
Are XOFs and KDFs more usable than DRBGs?
CSPRNGs have 2 design requirements:
output unpredictability,
back-tracing resistance.
In addition to which, NIST SP 800-90Ar1 added other features such as a) instance customization/personalization,...
- 9,672
2
votes
1
answer
247
views
AES key schedule. Does it use a KDF to generate the round keys?
So for each round in AES a different key is used, and as I saw the keys are created form a master key.
My question is how these round keys are generated.
Are they created via a Key Derivation ...
- 47
2
votes
1
answer
467
views
How to encrypt many files with AES-GCM, without running the key derivation function each time?
Linked question: AES encrypting multiple files
With a password, I have 100k files to encrypt. (Maybe 100k files today; or maybe 50k today, 10k tomorrow, and 40k ...
- 553