Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
7 votes
1 answer
3k views

Multiple AES Key Derivation from a master key

I need cryptography advice regarding this issue. Kamus is a service that encrypts secrets for applications running on Kubernetes. When using AES (actually, Rijndael) symmetric encryption, Kamus uses ...
Omer Levi Hevroni's user avatar
16 votes
1 answer
5k views

Security of KDF1 and KDF2 (hash based KDF's)

It's still common to come across implementations of KDF1 and KDF2. Basically these are KDF's that simply derive multiple keys from the key seed and a counter: $K_i = \operatorname{KDF}(K_{master}, i) ...
Maarten Bodewes's user avatar
  • 92.6k
4 votes
2 answers
2k views

Mathematical formula for switching the key for OTP?

Instead of generating the random key for the one time pad cipher over and over again, is there a mathematical formula that allows you to switch the key to a new key? The new key must be as random and ...
Anonymous's user avatar
7 votes
3 answers
3k views

Formal description of KDF1 and KDF2

I've seen many descriptions of KDF1 and KDF2 by now, but most documents simply point to specifications that are behind a pay wall. These standards are not specific to the KDF's; they just use these ...
Maarten Bodewes's user avatar
  • 92.6k
11 votes
1 answer
2k views

How random is the shared secret in the Diffie Hellman key agreement

How random is the value $ZZ$ in the DH protocol? This question was triggered by this somewhat naïve implementation in I2P shown by Sergei at Stackoverflow. Obviously $ZZ$ is distinguishable from a ...
Maarten Bodewes's user avatar
  • 92.6k
38 votes
4 answers
34k views

How can one securely generate an asymmetric key pair from a short passphrase?

Background info: I am planning on making a filehost with which one can encrypt and upload files. To protect the data against any form of hacking, I'd like not to know the encryption key ($K$) used for ...
Flumble's user avatar
  • 485
22 votes
2 answers
8k views

Deriving Keys for Symmetric Encryption and Authentication

So here's the concept. Rather than storing 2 keys and using a random IV, which presents its own problems (key rotation, ensuring no key is used in more than 2^32 cycles, sharing the keys, etc), is it ...
ircmaxell's user avatar
  • 425
11 votes
1 answer
3k views

How to salt PBKDF2, when generating both an AES key and a HMAC key for Encrypt then MAC?

When using Encrypt-then-MAC with AES and HMAC by password, and given 128 bits of payload with the ciphertext to store a random salt, which would be more secure: Using PBKDF2 with then entire 128 bit ...
jbtule's user avatar
  • 278
11 votes
4 answers
2k views

Which risks are associated with deriving multiple keys from the same DH secret Z?

NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment. NIST states ...
NotACryptographer's user avatar
5 votes
1 answer
2k views

ECDH security when no KDF is used

Let's suppose our device performs ECDH with a fixed, unknown, private key $\text{prv}$. It accepts as input any point $Q$ lying in the proper subgroup of the proper elliptic curve, then computes: $P =...
Ruggero's user avatar
  • 7,084
32 votes
2 answers
37k views

Key derivation functions (KDF): What are they, what are their main purposes and how they can be used?

What are KDFs? What are their main purposes? How they can be used, in other words, what's their drill in a cryptography scheme?
Samuel Paz's user avatar
9 votes
2 answers
5k views

Key Derivation Functions vs. Password Hashing Schemes

Key derivation functions, such as HKDF (standardized in RFC 5869), are meant to stretch some initial keying material having enough entropy, like a Diffie-Hellman shared value, into one or more strong ...
cryptopathe's user avatar
  • 1,185
7 votes
1 answer
2k views

Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?

PBKDF2 should only be used to generate a larger output than the hash function it uses if the output is used in such a way that it has a flat keyspace. As far as I am aware, XTS does not have a flat ...
forest's user avatar
  • 15.3k
4 votes
1 answer
9k views

DES Key Schedule Algorithm

Reading through the DES Specification it says that the keys are permuted with PC-1 initially and then shifted left both $C$ and $D$. However, before it gets ...
Dean's user avatar
  • 143
21 votes
6 answers
2k views

Why does PBKDF2 xor the iterations of the hash function together?

The definition of PBKDF2 states that I obtain a derived key (1) by calling a pseudorandom function a bunch of times recursively: $U_1 = PRF(password, salt)$ $U_2 = PRF(password, U_1)$ … $U_n = PRF(...
Cameron Skinner's user avatar
19 votes
0 answers
3k views

What's the difference between a Key Derivation Function and a Password-Hash? [duplicate]

It seems to me that anything that was sufficiently good as a KDF would work just fine as a password hash, though the reverse might not be true. Are there considerations specific to password-hashing ...
Jason's user avatar
  • 373
18 votes
2 answers
11k views

Deterministically generate a RSA public/private key pair from a passphrase (with sufficient entropy)?

Is it possible to deterministically generate public/private RSA key pairs from passphrases? Would giving the (key generating) algorithm data made from key-stretching the passphrase (instead of a ...
fadedbee's user avatar
  • 918
24 votes
6 answers
48k views

PBKDF2 and salt

I want to ask some questions about the PBKDF2 function and generally about the password-based derivation functions. Actually we use the derivation function together with the salt to provide ...
thrylos_7's user avatar
  • 341
14 votes
3 answers
4k views

PBKDF2 for key diversification

I am looking for a secure key diversification function to create individual AES keys for a local smart card deployment. The keys need to be derived from a secret master key and the smart card serial ...
ge0rg's user avatar
  • 243
14 votes
2 answers
2k views

Can any MAC be used as a KDF?

First, let me clarify what I mean with a Key Derivation Function (KDF). I'm interested in KDFs that take an $n$-bit symmetric master key and some diversification data of arbitrary length as input and ...
mtvec's user avatar
  • 243
9 votes
2 answers
2k views

Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?

I have a following use case: User has his master public (pk) - private (sk) key pair (Ed25519). In DB we store a public key. Is ...
Robert Zaremba's user avatar
9 votes
1 answer
2k views

Is the AES Key Schedule weak?

After reading this paper entitled Key Recovery Attacks of Practical Complexity on AES Variants With Up To 10 Rounds, I was left wondering why AES's key schedule is invertible. In the paper, the ...
user avatar
5 votes
1 answer
2k views

Is a PBKDF2-derived master key easier cracked if very many Data Protection Keys are derived from it?

I'm referring the NIST document about PBKDF2, NIST Special Publication 800-132, Recommendation for Password-Based Key Derivation, Part 1: Storage Applications, Page 8 and 9, section 5.4 Using the ...
tcboy88's user avatar
  • 195
3 votes
1 answer
2k views

HKDF: ikm, salt and info values

As indicated at Key generation for AES-GCM-256 file encryption I'm currently working on a file encryption software. In the above thread it was suggested that, for performance reasons, I use a ...
FineJoe's user avatar
  • 71
3 votes
1 answer
644 views

Is it safe to split the output of PBKDF2?

I would like to know if splitting a key generated by PBKDF2 to derive two keys is a safe practice. Concretely, in my system, I need to derive two keys. One for symmetric cipher used in the client ...
mc9's user avatar
  • 177
54 votes
1 answer
43k views

Password hashing security of argon2 versus bcrypt/PBKDF2?

I wonder if it can be approximated how much of a security margin the new argon2 hash, winner of the password hashing competition, can give over bcrypt or PBKDF2, for an attacker using large GPU ...
azren's user avatar
  • 751
29 votes
4 answers
7k views

Is there a hash function that's more expensive for an attacker than for the server?

Say a server wants to hash a password $p$. It would use a secure hash function $H$ and a unique salt $s$ to hash the password as $H(p,s)$. If one has access to the salt, each password candidate ...
n-l-i's user avatar
  • 445
25 votes
2 answers
17k views

What is the difference between Scrypt and PBKDF2?

After reading these two resources I am wondering am I getting all the differences between Scrypt and PBKDF2. As far as I understood, the similarity is: both are password-based key derivation ...
Salvador Dali's user avatar
17 votes
2 answers
2k views

Is bcrypt better than GnuPG's iterated+salted hashing method?

GnuPG has slow hash built-in in form of iterated+salted S2K. Does it have disadvantages in comparison with bcrypt or scrypt? Is GnuPG's slow hash method easily automated in GPUs?
Andrei Botalov's user avatar
10 votes
2 answers
7k views

How to derive a symmetric key from ECDH shared secret?

I am trying to implement the internal primitives of ECDH. Currently I'm able to multiply the receiver's public EC point with the sender's private key to arrive at the shared EC point. Next step is to ...
sce's user avatar
  • 257
8 votes
2 answers
5k views

What exactly does s2k do in gpg

So I recently discovered the --s2k mode in gpg. Sadly it is not very well-documented. I mean, what is ...
Richard R. Matthews's user avatar
8 votes
2 answers
11k views

What are KDF parameters in OpenSSL command-line utility for `enc`?

I refer to https://www.openssl.org/docs/manmaster/apps/enc.html and see that the only parameter for key derivation which I can set explicitly (not considering the obvious ...
A gee's user avatar
  • 83
7 votes
2 answers
6k views

How secure is it to use password as AES key?

I am developing a steganography app where user encrypt any file into an audio file. The user can enter a password to protect the hidden data. The same password is converted as a 256 bit key and the ...
Gerard Jean's user avatar
7 votes
2 answers
773 views

Entropy preservation through cryptographic hash function

Background First, while studying MinEntropy a bit, I came across an NIST paper, "DRAFT SP 800-90B (second draft)," which suggests "twice" the entropy of the underlying block of a cryptographic hash ...
Gratis's user avatar
  • 187
7 votes
1 answer
3k views

What information to include is the 'info' input for HKDF?

The RFC states the following: 3.2. The 'info' Input to HKDF While the 'info' value is optional in the definition of HKDF, it is often of great importance in applications. Its main objective is to ...
hunter's user avatar
  • 3,965
6 votes
1 answer
3k views

Can a raw ECDH shared secret be used directly for encryption?

If two parties calculate an ECDH shared secret can they (with no security weakness) use this raw value directly as an encryption key, assuming the underlying key and ECDH sizes match? Also the ...
big_fish_small_pond's user avatar
6 votes
1 answer
1k views

Computing IV for CBC from PBKDF2 + HKDF

Note that this question is somewhat similar to Can I use my random IV (for AES) as a salt for PBKDF2? My current encryption format computes two random PBKDF2 salts (encryption and HMAC, 8 bytes each) ...
Rob Napier's user avatar
5 votes
3 answers
2k views

Generate 2 independent keys from a master key

The scenario is like this: I need 2 keys for different purposes (encryption + encryption, encryption + mac, or whatever). Because it is not good practice to reuse the same key, I'd like the 2 keys to ...
Cyker's user avatar
  • 729
4 votes
1 answer
4k views

RSA key pair generation using PRNG with same seed

I see a lot of Q/A where persons are trying to generate a specific key pair using static data such as a password. Now say we use a known PRNG (dangerous assumption), seeded with a the data as a static ...
Maarten Bodewes's user avatar
  • 92.6k
4 votes
1 answer
4k views

Clarification needed in TLS 1.2 key derivation process

Reference to TLS 1.2 standard documentation section 6.3 regarding the key generation here: To generate the key material, compute ...
user6875880's user avatar
3 votes
3 answers
1k views

Can I dynamically calculate an appropriate number of iterations for PBKDF2 based on the system time, rather than using a fixed value?

Could you choose the number of PBKDF2 iterations based upon the system time? I've heard a few people recommend that the number of iterations for PBKDF2 should be doubled every two years (starting with ...
ezzatron's user avatar
  • 133
3 votes
1 answer
2k views

Encryption and HMAC key derivation

I'm deriving keys from a user-supplied passphrase for symmetric encryption using AES-256 in CBC mode with a HMAC for authenticity/integrity. My key derivation function currently looks like this: ...
Naftuli Kay's user avatar
3 votes
3 answers
558 views

Memory hard key derivation (password hash) using AES encryption

I am restricted on a certain environment involving PHP and am currently unable to implement new memory hard hashes such as scrypt (and I am not trying to compete with the likes of scrypt). My ...
azren's user avatar
  • 751
3 votes
3 answers
900 views

Entropy of system data - use all and hash, or trim least significant bits?

I'm working on a background entropy collector for key generation that monitors hardware and produces an entropy pool. Here's my list of sources: Mouse position Keyboard timings (i.e. time between ...
Polynomial's user avatar
  • 3,527
3 votes
1 answer
550 views

Bitwise method of generating r for RSA-KEM

It seems that RSA-KEM has a very troublesome method of generating the secret $r$. It seems that the random value needs to be in the range $0 \le r \le {n - 1}$. Now most cryptographic environments ...
Maarten Bodewes's user avatar
  • 92.6k
2 votes
3 answers
491 views

Are XOFs and KDFs more usable than DRBGs?

CSPRNGs have 2 design requirements: output unpredictability, back-tracing resistance. In addition to which, NIST SP 800-90Ar1 added other features such as a) instance customization/personalization,...
DannyNiu's user avatar
  • 9,207
2 votes
1 answer
943 views

Is this key management scheme secure?

I'm designing a scheme for management of a small number of cryptographic keys (< 100 at any given time) and I had an idea: rather than storing all the keys, could I just store one master key and ...
pg1989's user avatar
  • 4,636
2 votes
1 answer
559 views

Key Derivation Function (KDF): Can a key derived from KDF be considered as a secure key?

Consider a case where we have a master key MS that is used in pseudo-random function to generate a set of pseudo-random values. Then we use key derivation function to derive a key from each of pseudo-...
user153465's user avatar
  • 1,583
2 votes
1 answer
236 views

AES key schedule. Does it use a KDF to generate the round keys?

So for each round in AES a different key is used, and as I saw the keys are created form a master key. My question is how these round keys are generated. Are they created via a Key Derivation ...
user67441's user avatar
2 votes
1 answer
449 views

How to encrypt many files with AES-GCM, without running the key derivation function each time?

Linked question: AES encrypting multiple files With a password, I have 100k files to encrypt. (Maybe 100k files today; or maybe 50k today, 10k tomorrow, and 40k ...
Basj's user avatar
  • 553