Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
67 votes
4 answers
13k views

Why does the FBI ask Apple for help to decrypt an iPhone?

The current debate of the FBI trying to get Apple to assist in decrypting an iPhone made me wonder: Normally, upon turning on an iPhone, everything is decrypted using a 4-digit pin (or actually, a ...
RocketNuts's user avatar
  • 1,387
54 votes
1 answer
43k views

Password hashing security of argon2 versus bcrypt/PBKDF2?

I wonder if it can be approximated how much of a security margin the new argon2 hash, winner of the password hashing competition, can give over bcrypt or PBKDF2, for an attacker using large GPU ...
azren's user avatar
  • 751
38 votes
4 answers
34k views

How can one securely generate an asymmetric key pair from a short passphrase?

Background info: I am planning on making a filehost with which one can encrypt and upload files. To protect the data against any form of hacking, I'd like not to know the encryption key ($K$) used for ...
Flumble's user avatar
  • 485
32 votes
6 answers
5k views

What is the practical impact of using System.Random which is not cryptographically random?

I recently noticed a .NET software using PBKDF to derive an encryption key from a password string. This password string was ...
learnerX's user avatar
  • 687
32 votes
2 answers
37k views

Key derivation functions (KDF): What are they, what are their main purposes and how they can be used?

What are KDFs? What are their main purposes? How they can be used, in other words, what's their drill in a cryptography scheme?
Samuel Paz's user avatar
32 votes
3 answers
19k views

How many KDF rounds for an SSH key?

What is the best practice on choosing how many key derivation function (KDF) rounds/iterations when generating an SSH key pair with ssh-keygen? Am I correct in saying that it is unnecessary if the ...
Peter Tseng's user avatar
29 votes
4 answers
7k views

Is there a hash function that's more expensive for an attacker than for the server?

Say a server wants to hash a password $p$. It would use a secure hash function $H$ and a unique salt $s$ to hash the password as $H(p,s)$. If one has access to the salt, each password candidate ...
n-l-i's user avatar
  • 445
25 votes
2 answers
17k views

What is the difference between Scrypt and PBKDF2?

After reading these two resources I am wondering am I getting all the differences between Scrypt and PBKDF2. As far as I understood, the similarity is: both are password-based key derivation ...
Salvador Dali's user avatar
24 votes
6 answers
48k views

PBKDF2 and salt

I want to ask some questions about the PBKDF2 function and generally about the password-based derivation functions. Actually we use the derivation function together with the salt to provide ...
thrylos_7's user avatar
  • 341
24 votes
1 answer
1k views

Memory-hard password hash in practice?

Dan Boneh, Henry Corrigan-Gibbs, and Stuart Schechter have proposed Balloon Hashing: A Memory-Hard Function Providing Provable Protection Against Sequential Attacks (in proceedings of AsiaCrypt 2016). ...
fgrieu's user avatar
  • 141k
22 votes
2 answers
8k views

Deriving Keys for Symmetric Encryption and Authentication

So here's the concept. Rather than storing 2 keys and using a random IV, which presents its own problems (key rotation, ensuring no key is used in more than 2^32 cycles, sharing the keys, etc), is it ...
ircmaxell's user avatar
  • 425
21 votes
6 answers
2k views

Why does PBKDF2 xor the iterations of the hash function together?

The definition of PBKDF2 states that I obtain a derived key (1) by calling a pseudorandom function a bunch of times recursively: $U_1 = PRF(password, salt)$ $U_2 = PRF(password, U_1)$ … $U_n = PRF(...
Cameron Skinner's user avatar
19 votes
1 answer
2k views

Compressing EC private keys

For reasonable security, EC private keys are typically 256-bits. Shorter EC private keys are not sufficiently secure. However, shorter symmetric keys (128-bits, for example) are comparably secure. I ...
David Schwartz's user avatar
19 votes
0 answers
3k views

What's the difference between a Key Derivation Function and a Password-Hash? [duplicate]

It seems to me that anything that was sufficiently good as a KDF would work just fine as a password hash, though the reverse might not be true. Are there considerations specific to password-hashing ...
Jason's user avatar
  • 373
18 votes
2 answers
11k views

Deterministically generate a RSA public/private key pair from a passphrase (with sufficient entropy)?

Is it possible to deterministically generate public/private RSA key pairs from passphrases? Would giving the (key generating) algorithm data made from key-stretching the passphrase (instead of a ...
fadedbee's user avatar
  • 918
17 votes
2 answers
2k views

Is bcrypt better than GnuPG's iterated+salted hashing method?

GnuPG has slow hash built-in in form of iterated+salted S2K. Does it have disadvantages in comparison with bcrypt or scrypt? Is GnuPG's slow hash method easily automated in GPUs?
Andrei Botalov's user avatar
16 votes
4 answers
20k views

Looking at hash output – is Base64 encoding in any way better than HEX encoding?

I was wondering why most "normal/unsafe" crypto hashes like SHA-256, SHA-512, Whirlpool, RipeMD-160, MD5, etc. are HEX encoded. But most "secure" crypto hashes (KDF' ) like ...
Richard R. Matthews's user avatar
16 votes
3 answers
2k views

Is it better to maximize memory usage or number of passes with Argon2i 1.3?

I wrote a small application that uses Argon2i for deriving symmetric keys for encryption of local files and secret Curve25519 keys. Argon2i v1.3 is susceptible to TMTO attacks if the number of passes ...
user avatar
16 votes
1 answer
5k views

Security of KDF1 and KDF2 (hash based KDF's)

It's still common to come across implementations of KDF1 and KDF2. Basically these are KDF's that simply derive multiple keys from the key seed and a counter: $K_i = \operatorname{KDF}(K_{master}, i) ...
Maarten Bodewes's user avatar
  • 92.6k
14 votes
2 answers
2k views

Can any MAC be used as a KDF?

First, let me clarify what I mean with a Key Derivation Function (KDF). I'm interested in KDFs that take an $n$-bit symmetric master key and some diversification data of arbitrary length as input and ...
mtvec's user avatar
  • 243
14 votes
3 answers
4k views

PBKDF2 for key diversification

I am looking for a secure key diversification function to create individual AES keys for a local smart card deployment. The keys need to be derived from a secret master key and the smart card serial ...
ge0rg's user avatar
  • 243
14 votes
7 answers
9k views

Generate Elliptic Curve Private Key from User Passphrase?

I'd like to generate a private elliptic curve key from user input like pass phrase. Is the best way to do this with a key derivation function like PBKDF2? Is there a better way? Edit (based upon @...
JP Richardson's user avatar
14 votes
1 answer
8k views

argon2 vs scrypt

It's a fact that scrypt and argon2 are the two dominant memory hard KDFs. But which one of them is more recommendable for password hashing? scrypt is older and as far as I know resistant to almost ...
Richard R. Matthews's user avatar
13 votes
2 answers
1k views

Can any block cipher in CTR mode be used as a CSPRNG?

I have been learning about block ciphers, modes of operations, and csprngs by myself for a few days and there are some things I'm unsure about. Assuming we only talk about cryptographically secure ...
Qøtēx's user avatar
  • 135
13 votes
1 answer
11k views

Is there any benefit from using SHA-512 over SHA-256 when AES just truncates it anyway?

I am still not very clear on how AES-256-CBC can use SHA-512 bit keys, but I assume that it just truncates the 512bit hash down to 256bit. In software like GnuPG and OpenPGP, is there any real benefit ...
user4191887's user avatar
13 votes
3 answers
3k views

What is a Key Derivation Function?

From Wikipedia: In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or ...
RandomGuy's user avatar
  • 318
12 votes
3 answers
5k views

How much security is gained from hiding the nonce?

Public nonces can be problematic for privacy when they can be considered metadata. They can also be troublesome for security if you do things like using a hash of the message as the nonce. PASETO now ...
samuel-lucas6's user avatar
12 votes
2 answers
3k views

Why does Signal repeatedly hash the secure passphrase?

Background: I'm working on creating a small program to extract my messages from Signal's newly-added (beta) encrypted backup feature. In the Signal codebase for their Android app, I noticed that ...
Aster's user avatar
  • 231
12 votes
3 answers
4k views

Is deriving the IV from the password secure?

I came across an encryption scheme to encrypt files with AES-256. You can see the initialization of the decryption routine below: ...
Jonas's user avatar
  • 223
12 votes
0 answers
2k views

Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information on its advantages against CBC ...
OughtToPrevail's user avatar
11 votes
1 answer
2k views

How random is the shared secret in the Diffie Hellman key agreement

How random is the value $ZZ$ in the DH protocol? This question was triggered by this somewhat naïve implementation in I2P shown by Sergei at Stackoverflow. Obviously $ZZ$ is distinguishable from a ...
Maarten Bodewes's user avatar
  • 92.6k
11 votes
1 answer
3k views

How to salt PBKDF2, when generating both an AES key and a HMAC key for Encrypt then MAC?

When using Encrypt-then-MAC with AES and HMAC by password, and given 128 bits of payload with the ciphertext to store a random salt, which would be more secure: Using PBKDF2 with then entire 128 bit ...
jbtule's user avatar
  • 278
11 votes
4 answers
2k views

Which risks are associated with deriving multiple keys from the same DH secret Z?

NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment. NIST states ...
NotACryptographer's user avatar
11 votes
2 answers
4k views

Why do some key derivation functions (like PBKDF2) use a salt?

Let me start by explaining my understanding of the various concepts involved in this question: Salt: Random bytes of data used as secondary input for a password hashing function, like so: ...
Aran-Fey's user avatar
  • 212
11 votes
2 answers
5k views

Meaning of the term "Key Material"

I am reading specifications from my client that focuses on the topic of security. In these specs, the term key material has appeared many times. I used Google to look for what the term means. ...
mac.ma's user avatar
  • 211
11 votes
1 answer
689 views

Can someone clarify two things about the HKDF by Krawczyk?

I got a question about the HKDF Scheme by Hugo Krawczyk. On the following link you can find a small explanation of the HKDF-Scheme and some short informations. The HKDF specification itself has been ...
chris000r's user avatar
  • 519
10 votes
2 answers
7k views

How to derive a symmetric key from ECDH shared secret?

I am trying to implement the internal primitives of ECDH. Currently I'm able to multiply the receiver's public EC point with the sender's private key to arrive at the shared EC point. Next step is to ...
sce's user avatar
  • 257
10 votes
2 answers
32k views

AES encryption using a Diffie-Hellman key exchange

I have two systems which need to encrypt their communication by AES-128. The key for the AES encryption should be exchanged with the Diffie-Hellman (DH) algorithm. Now, I've read about DH and got a ...
user avatar
10 votes
1 answer
5k views

What is the algorithm behind PasswordDeriveBytes?

Microsoft has created an implementation of PBKDF1 in the PasswordDeriveBytes class. It can however generate more bytes than PBKDF1, which is limited to the number ...
Maarten Bodewes's user avatar
  • 92.6k
10 votes
1 answer
1k views

Are there any authoritative definitions of "key stretching"?

This is mostly a terminology question, but I suppose that it is best asked and answered here. After browsing the Internet I have come across a fair number of completely different definitions of the ...
Henrick Hellström's user avatar
10 votes
1 answer
7k views

What's the most secure way to derive a key from a password repeatably?

I'm trying to write a cloud storage application where everything the user uploads is unreadable by the server, encrypted client-side before being sent. Currently, the flow looks like this: User ...
user2589389's user avatar
9 votes
2 answers
5k views

Key Derivation Functions vs. Password Hashing Schemes

Key derivation functions, such as HKDF (standardized in RFC 5869), are meant to stretch some initial keying material having enough entropy, like a Diffie-Hellman shared value, into one or more strong ...
cryptopathe's user avatar
  • 1,185
9 votes
3 answers
4k views

Reason(s) for using a KDF for encryption keys

Assuming I already have a 256-key (32 char password) for AES encryption, comprised of random alpha-numeric characters and punctuation (95 possible ascii chars), generated by a decent PRNG, is there ...
hunter's user avatar
  • 3,965
9 votes
2 answers
2k views

Is it possible to derive a public key from another public key without knowing a private key (Ed25519)?

I have a following use case: User has his master public (pk) - private (sk) key pair (Ed25519). In DB we store a public key. Is ...
Robert Zaremba's user avatar
9 votes
2 answers
853 views

Key derivation on Arduino

The ATmega2560 is slow - it's a single core, 16MHz 8-bit AVR. Despite that, I need to use some encryption on it, and since it is limited to a few blocks, AES-256 can be used. However, the key ...
Dash's user avatar
  • 95
9 votes
1 answer
2k views

Is the AES Key Schedule weak?

After reading this paper entitled Key Recovery Attacks of Practical Complexity on AES Variants With Up To 10 Rounds, I was left wondering why AES's key schedule is invertible. In the paper, the ...
user avatar
8 votes
2 answers
5k views

What exactly does s2k do in gpg

So I recently discovered the --s2k mode in gpg. Sadly it is not very well-documented. I mean, what is ...
Richard R. Matthews's user avatar
8 votes
2 answers
758 views

Are there key-derivation functions that are safe to use in parallel on the same secret?

I'm considering using a key-derivation scheme for generating multiple keys from the same user secret. It is important that given all but one of these derived keys, it is not feasible to calculate the ...
Filip Haglund's user avatar
8 votes
2 answers
846 views

Do you really need a KDF when you have a PRF?

My understanding is that a KDF is like a PRF, except that it has a preliminary step that "extract" entropy. It is thus needed when the entropy is non-uniform (for example the output of ECDH is modulo ...
David 天宇 Wong's user avatar
8 votes
3 answers
3k views

Blake2B as a KDF

How would one go about using vanilla keyed Blake2B as a KDF with high-entropy inputs. Assume I don't have access to more specialized algorithms such blake2XB, HKDF, etc. Salt - high entropy per-...
hunter's user avatar
  • 3,965

1
2 3 4 5
13