Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
2
votes
1answer
116 views

Pepper and key derivation/stretching

I understand the pepper concept of adding but not storing a secret and iterating through the set of possible secret values for verifying. But is pepper also useful when it comes already to the use of ...
0
votes
1answer
187 views

Generating 1024 bits of entropy from a seed

I need to generate 1024 pseudo-random bits from a 100 bytes string seed (only valid lowercase chars) One thing I'm pretty sure would be secure enough would be to repeat this 100 bytes string 20 times ...
4
votes
1answer
64 views

Key Derivation Functions offering better than 2^hlen security?

On page 21 of his HKDF paper, Krawczyk criticized one of the stated desirable features of KDFs from the paper “On The Security of Key Derivation Functions” (Emphasis mine): Due to the way the hash ...
3
votes
1answer
515 views

Is it secure to use so many iterations of AES-CBC as a KDF so that it's slow even using AES-NI?

Note: This is not the same as Multiple iterations of AES for key derivation?. Almost everyone has AES-NI nowadays - when building a cryptographic application, is is possible to leverage this to ...
13
votes
1answer
7k views

Is there any benefit from using SHA-512 over SHA-256 when AES just truncates it anyway?

I am still not very clear on how AES-256-CBC can use SHA-512 bit keys, but I assume that it just truncates the 512bit hash down to 256bit. In software like GnuPG and OpenPGP, is there any real benefit ...
1
vote
2answers
621 views

What is transaction capacity of a POS using 3DES DUKPT?

I am looking for the transaction capacity of a Point-Of-Sale device using 3DES DUKPT. Once all keys derived from the future key set are exhausted (1M or 500K?), how will the POS be reloaded with a new ...
0
votes
1answer
287 views

What operation does $\|$ denote in ANSI X9.63 KDF? [duplicate]

Can someone tell me in laymens terms what this is? $$K_i = \mathrm{Hash}(Z \| \mathit{Counter} \| [\mathit{SharedInfo}])$$ What do the double pipes represent?
5
votes
2answers
2k views

Why does openssl derive IVs from a password?

From https://wiki.openssl.org/index.php/Manual:Enc(1): When a password is being specified using one of the other options, the IV is generated from this password. Why does OpenSSL do this? My ...
3
votes
1answer
241 views

Does it matter whether the KDF salt is integrity protected?

I am writing a simple application, mainly as a fun challenge, but also to hopefully someday use as my password manager. I'm using pynacl's SecretBox, which ...
-1
votes
1answer
431 views

Key Derivation Function (KDF) Usage [closed]

Is it common to have a KDF implementation in order to safely store passwords? Do IT-companies use KDF? Or do they usually rely on other algorithms? If you have any practical example for the second ...
3
votes
1answer
186 views

Necessary to authenticate nonce if authentication-key is derived from nonce?

Lets suppose my messages are composed like this: unique_message_nonce + encrypted_message + mac Because I don't have an AEAD-scheme, I can encrypt and authenticate ...
1
vote
1answer
962 views

The number of keys generated in TLS 1.2?

In section 6.3. Key Calculation in the standard documentation here, I see the following: The master secret is expanded into a sequence of secure bytes, which is then split to a client write MAC ...
1
vote
2answers
359 views

how does hkdf generate 2 keys?

Hi I am new to cryptography and am confused as to how HKDF generates two separate keys from one single key/password. Is it as follows? Key 1: HKDF-Extract(salt, IKM) -> PRK Key 2: HKDF-Expand(PRK, ...
4
votes
2answers
229 views

Can we have single hash function both for data integrity and key derivation function?

Can we have single hash function both for data integrity and key derivation function? Why and Why not? Any link describing difference analytically will be appreciated. Thanks.
4
votes
1answer
1k views

Clarification needed in TLS 1.2 key derivation process

Reference to TLS 1.2 standard documentation section 6.3 regarding the key generation here: To generate the key material, compute ...
3
votes
2answers
704 views

For encryption with a passphrase, should you re-use the same salt for key generation?

Let's say I have a simple "vault" application where users can enter data and a passphrase, and it will be encrypted, requiring them to re-enter the passphrase to decrypt it. This would be implemented ...
4
votes
3answers
2k views

How likely is a AES KDF bypass?

So I was wondering about some alternative attack scenario which I thought of when I started to understand KDF's . So lets say you have a cipher like AES and a strong KDF . And the legit user uses a ...
4
votes
1answer
553 views

Some Questions about the Veracrypt hash functions

Veracrypt has always been my favourite encryption tool since it came out . But still there are some things about the tool I don't understand . Why is there the possibility to use sha256 or sha512 . ...
1
vote
1answer
874 views

What is meant by “KDF2” vs “PBKDF2”?

I see many references to KDF2 here, but all links are broken and Wikipedia does not have an entry for KDF2. Is KDF2 a specific standard for Key Derivation without a password? Ultimately, I am trying ...
1
vote
1answer
36 views

how can I draw from a set of characters using a seed for entropy?

Given a seed string S, I want to deterministically generate a password of the form: N characters, each chosen from a set of characters C Unfortunately neither N nor the cardinality of C necessarily ...
5
votes
2answers
2k views

Derive a secret from an RSA private key

What I want to do is deterministically derive a secure key from an RSA private key, such that the RSA private key cannot be derived from the secure key. The first approach that came to mind was ...
5
votes
2answers
2k views

Is SHA 2 suitable for key derivation?

Let's imagine that I've got a number modulo n given by DH protocol. I want to use it as a key for AES encryption. So I have to cut this number to fit it in AES (...
2
votes
1answer
377 views

What is the key derivation function used in GnuPG, and how long may its input be?

I am currently working with GnuPG on a new project of mine. It would be very useful to know two things for that, which are not described in the manual: What is the maximum input size of a symmetric ...
18
votes
0answers
584 views

Memory-hard password hash in practice?

Dan Boneh, Henry Corrigan-Gibbs, and Stuart Schechter have proposed Balloon Hashing: A Memory-Hard Function Providing Provable Protection Against Sequential Attacks (in proceedings of AsiaCrypt 2016). ...
3
votes
1answer
104 views

Is there a KDF that can be computed in an untrusted environment?

I'm looking for a Key Derivation Function, kind of like PBKDF2 or Scrypt, but which can be computed by a machine you don't trust. Some way to give it a derivative of the source password, such that ...
7
votes
3answers
3k views

Reason(s) for using a KDF for encryption keys

Assuming I already have a 256-key (32 char password) for AES encryption, comprised of random alpha-numeric characters and punctuation (95 possible ascii chars), generated by a decent PRNG, is there ...
1
vote
1answer
121 views

Do PBKDF2 keys generated at a lower iteration count leak information?

Assume the threat model here is that the server is not to be trusted and the client is trusted. A user registers for an account and the client chooses an iteration count of 50,000 to generate a 512 ...
5
votes
2answers
5k views

Why are ephemeral/session/temporary keys useful?

One reason that communication protocols use ephemeral keys is to help with implementing Perfect Forward Security. They're also used in SSL to go from using RSA to using a faster symmetric encryption. ...
2
votes
1answer
1k views

SHA-256 support for SecretKeyFactory in Java 6 and 7?

According to the following linked Java documentation, the relevant option for SecretKeyFactory algorithm (ignoring deprecated options involving MD5 or DES etc.) running in JRE 6 and JRE 7 is: ...
1
vote
1answer
181 views

Can key-wrapping help to securely change passphrase used to generate encryption key?

I am working on financial application where users' data are encrypted with symmetric cipher (AES-256), encryption keys is derived with KDF from user's password. I am looking for way how to give to my ...
0
votes
1answer
50 views

Formal Information-Theoretic Key Expansion Definition

Is there a formal definition for a protocol that expands keys that are pre-shared among 2 or more parties? How about an informal definition? Example: Alice and Bob pre-share a $n$-bit string $k$. ...
4
votes
1answer
1k views

Can a raw ECDH shared secret be used directly for encryption?

If two parties calculate an ECDH shared secret can they (with no security weakness) use this raw value directly as an encryption key, assuming the underlying key and ECDH sizes match? Also the ...
1
vote
1answer
130 views

FHMQV-C \sigma calculation - Full Dual Exponential Challenge Response (FDCR) signature schemes-

I'm studying the protocol FHMQV - C but I don't understand how two honest parties can reach the same value of $\sigma$. The paper that I'm studying is: https://eprint.iacr.org/2009/408.pdf. If you ...
0
votes
1answer
282 views

Cryptographic notation in X3DH Key Agreement Protocol

Can someone please explain the below paragraphs from section 2.2 in The X3DH Key Agreement Protocol? Please try to explain the whole paragraphs. 1st paragraph: I want to understand how the DH ...
-2
votes
1answer
157 views

Help in decrypting this message: “e811339cf0258d2977fdefcd110c0e17daa5de81”? [closed]

Here are some details: I was given was a text that was converted into hexadecimal, then hashed via MD5, then hashed via SHA-1. That’s all I know about it. Any help is really appreciated. There is ...
3
votes
1answer
455 views

Sequential public key generation with secret private keys?

So this is an idea that popped into my head the other day and I wonder if there are any known crytographic schemes with these properties? Is there a way to construct a public / private key system in ...
7
votes
1answer
1k views

Why does LastPass hash their passwords with PBKDF2 this way?

LastPass is a password manager that I am sure many of you are familiar with. I have been studying LastPass's source code a bit. From their FAQs and what I can gather from their source code, the way ...
0
votes
1answer
64 views

Restricting symmetric key usage

I have a system where some clients communicate with a server. every client has its own name and role and some other parameters that sends these info to the server in every message and the server uses ...
1
vote
1answer
342 views

Is there a recommendation or standard for using SCRYPT as an unbounded length KDF and not a fixed length authentication hash?

How would I go about this? I don't want to roll my own but I do really want to use SCRYPT as a KDF for several algorithms, some of which require an output length longer than the SHA-256 hash. ...
13
votes
2answers
877 views

Can any block cipher in CTR mode be used as a CSPRNG?

I have been learning about block ciphers, modes of operations, and csprngs by myself for a few days and there are some things I'm unsure about. Assuming we only talk about cryptographically secure ...
1
vote
2answers
127 views

Should I use independent symmetric keys for each client should I use keys derived from a master key?

I have several clients that I communicate with from a central location. All connections are encrypted using static symmetric keys that are hard-coded in each client config file. I use a different key ...
1
vote
1answer
568 views

Is key derivation of a token shared secret necessary for usage of token in TOTP as specified by RF6238?

TL;DR: Is it necessary to generate a 'random' key from a shared token secret string before putting it into a TOTP algorithm that follows the RFC 6238 specification? Or is it okay for me to put the ...
7
votes
1answer
258 views

Key derivation after ECDH: why h(q ‖ pk1 ‖ pk2)?

I want to use the X25519 DH key agreement for generating a single AES-128 key. The distribution of the shared secret of such a key agreement is not uniform, so it shouldn't be used directly. The ...
1
vote
0answers
35 views

Shall I use individual or common signing keys for different roles?

I have a server S to which a client system can establish connections using predefined roles R1, R2, ...Rn. For mutal exchange of data and for authentication with GCM/GMAC a set of symmetric AES-128 ...
8
votes
1answer
254 views

Is a key ratchet effective against replay attacks?

In the answer to this question, a message counter is used to protect against replay attacks. Could a key ratchet be used instead? The basic idea is that with every message sent, the symmetric ...
0
votes
1answer
161 views

Does mixing two derived keys make a stronger key? And if so, how would I mix?

I have to generated a secure key from some meta data and a password, and I'm free to choose among a dozen of key derivation functions (KDFs). The problem is, I'm not too happy with either one. Some ...
0
votes
1answer
75 views

Are there any downsides to key stretching an already high quality entropic key?

For example, if we grab 50 bytes from a high quality source and run them through a key stretching function like Argon2 and have it generate a 32 byte secret for AES. Is there any downside to this? Do ...
2
votes
1answer
390 views

chaining multiple key derivation functions together

I was looking at PBKDF2, bcrypt and scrypt as options for key derivation; and would like to try using them all together in order to get the cryptographic strength of the strongest one (which seems to ...
1
vote
2answers
122 views

P2P encryption - Do I need a different session key each time?

I am using AES128-CBC+HMAC for all encryption. Currently I am using the same encryption and authentication/MAC key (Both derived from a master key with HKDF). Assuming that forward secrecy is not a ...
3
votes
3answers
394 views

Use of PBKDF2 when no access to HKDF?

I would like to use a unique encryption key and authKey for each payload that I encrypt and authenticate via AES256 CBC with HMAC-SHA256. I'm considering the following: ...