We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
1
vote
2answers
316 views

In RSA, is it possible to compute the private key if one knows one of the primes used to generate n?

Within RSA the private key can be derived if one knows both $p$ and $q$. Is it possible to derive the RSA private key or decrypt / learn something about encrypted messages if you only know one of the ...
2
votes
1answer
174 views

Revoke a GPG key using previously generated revoke certificate after renewd (change expiration date)

I have few sub-questions Do secret keys get expired, or just the public key gets expired? Do I have to back up the master sec key each time I renew it? For an ...
0
votes
1answer
225 views

Good practices for AES key derivation and management

I'm developping a device based on STM32L4x6. It is connected through BLE to a smartphone and it exchanges encrypted data with it. Data consists of health data of patients. Encryption is AES-GCM 256 ...
1
vote
0answers
126 views

Securing MQTT communication

I am building kinda simple IoT project, but I would like to implement good security (just for educational purposes and fun). My plan is to build simple solution where one arduino board reads some data ...
0
votes
1answer
62 views

correct a corrupted shared key

Suppose we have an almost shared secret. For example if we have a noisy connection to a shared secret source of randomness. So Alice has $k_1$ and Bob has $k_2$ similar but not necessarily identical ...
3
votes
1answer
348 views

Turn a password into a key without using salt

Assume I have a password with sufficient entropy but may not be uniformly distributed, how can I turn the password into a key that can be used for symmetric encryption? I think there is surely such a ...
4
votes
3answers
542 views

Generate 2 independent keys from a master key

The scenario is like this: I need 2 keys for different purposes (encryption + encryption, encryption + mac, or whatever). Because it is not good practice to reuse the same key, I'd like the 2 keys to ...
2
votes
0answers
465 views

Curve25519 / Ed25519 - Generate a private key from this term

I have 2 key pairs $(x_1, y_1)$, $(x_2, y_2)$. I also have $a = $random 256-bit array and $b = $256-bit of defined values from me. I know the values for $(x_1, y_1)$, $x_2$ and $b$. But I miss the ...
2
votes
2answers
142 views

Why is it recommended to hash passwords with a secret salt?

NIST recommends doing an additional round of hashing using a secret salt: In addition, verifiers SHOULD perform an additional iteration of a key derivation function using a salt value that is ...
1
vote
1answer
50 views

Why the output length of a KDF should be the same as the underlying OWF?

Quote: The chosen output length of the key derivation function SHOULD be the same as the length of the underlying one-way function output. Could someone please help explain the benefits and ...
2
votes
0answers
71 views

Sharing salt for deterministic symmetric key derivation

I have a requirement to generate and share unique symmetric keys for a large numbers of small data objects. In many cases the storage and retrieval of the key for each object will be a significant ...
4
votes
2answers
181 views

Are PBKDF2 derived keys related if only the number of iterations is changed?

I'd like to encrypt my disk with a password. To generate a nice key from a password, I used PBKDF2, which applies a hash function $k$ times to a cleartext and outputs the final result. When I ...
1
vote
2answers
451 views

Relationship between PRF/KDF/MAC?

It seems that not every MAC is a KDF. But would any PRF also work as both KDF and MAC? Could someone explain the relationship between these 3 definitions?
1
vote
0answers
45 views

Question on inputs of PRFs and HKDF KDF

I've read a lot of information about PRNGs, PRFs and KDFs. As far as I know: PRNG: The seed for the PRNG must be a uniform string. It transforms a short real uniform string into some bits of pseudo-...
3
votes
1answer
95 views

Block cipher birthday bound and a KDF workaround

Can the birthday bound arising from a block cipher’s block size be worked around by deriving different keys from the master key with a KBKDF using a tweak? For example consider the following scheme, ...
2
votes
1answer
451 views

HMAC SHA256 for deriving session keys using random nonce

I need to derive session key in order to create an application layer secure channel between mobile app and a bluetooth device. My scheme is similar to this scheme that uses a HMAC and counter. ...
1
vote
1answer
180 views

derive child keys from a private key

My problem is the following: I have an organization with many members. When someone from the outside communicates with this organization, I want any member to be able to decrypt the communication. ...
5
votes
1answer
471 views

Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?

PBKDF2 should only be used to generate a larger output than the hash function it uses if the output is used in such a way that it has a flat keyspace. As far as I am aware, XTS does not have a flat ...
2
votes
1answer
62 views

Reveal all information up to n-th message

Is there a way to generate a sequence of keys that have the property that exposing any of those keys will reveal all previous keys, but no future key? I'm thinking about an application that sends an ...
0
votes
2answers
408 views

Multiple key generator

I need an algorithm for "key generator". It should be initialized with some secret data, such as a (hashed) passphrase, or something generated once by some 3rd-party code. Given some small input it ...
1
vote
1answer
39 views

Encryption program conseil

I'm writing a little program to encrypt and decrypt a file. I'm using AES encryption in CTR mode that takes a key generated by a KDF (script). I have read some articles about cryptography but I have ...
1
vote
0answers
46 views

Time-sensitive key derivation for sharing with third-party

Devices: In this system, users have one or more wearable devices (a smart watch), one of which they will most likely have on their person all the time. The devices are linked to their account by their ...
3
votes
1answer
344 views

Combining multiple cryptographic keys to generate an encryption key

We have a system that has several SecretKeys (for example, one for a user, and one for us). We want to encrypt data in a way that requires all of those keys to be available in order to decrypt. I ...
3
votes
2answers
282 views

Using HKDF to derive symmetric keys from a hybrid public-key encryption scheme

RFC 5869 describes HMAC-based Extract-and-Expand Key Derivation Function (HKDF). In section 4, entitled "Applications of HKDF", it states that one of the intended uses is: derivation of symmetric ...
0
votes
1answer
96 views

is it safe to leak some information about scrypt result?

I am encrypting a file via AES-CBC and am using scrypt to extract a key from a user-provided password. The IV is public and is stored with the encrypted file. Is it safe to generate my IV (public) ...
-4
votes
1answer
91 views

How to reversely compute from hash [closed]

What are practical methodologies to derive the following ciphertext: 1bd0d370b262d748b21c40cc7e5746642b4c06079a224c65e443e429289753c2
2
votes
0answers
85 views

Can proofs be relayed to derived keys?

I am aiming to find out if this problem/puzzle can be solved with cryptography at all. Say there are these two parties: Subject S which has a master private/public key pair (MPriv, MPub) and a set of ...
4
votes
1answer
412 views

How secure is using a hash function as Key Derivation Function?

I am developing a personal project and I have the following need: given a randomly generated seed (with enough entropy) I need to generate a number $x$ of Ed25519 key pairs. These key pairs are not ...
2
votes
1answer
77 views

Can private key be specified on key pair creation?

Without regards to any specific implementation of asymmetric cryptography, I am wondering if it is feasible to come up with a value of private key I want to use, and calculate the corresponding public ...
2
votes
0answers
60 views

Did “The Catena Password-Scrambling Framework” make an error in the reduction of its pseudorandomness?

I was reviewing the most recent version of the Catena paper and they made some claims that I find questionable in their reduction of the pseudorandomness of the output of Catena (p. 32). First I will ...
4
votes
1answer
105 views

PBKDF security if all but one keys are exposed

I'm trying to understand the security of KDF but stuck with PBKDF case (case 3). Suppose, we have the following settings: $KDF(SK,salt_1) \rightarrow k_1$ $KDF(SK,salt_2) \rightarrow k_2$ The ...
2
votes
0answers
250 views

The right way to encrypt sensitive data with an user password

I am developing something like 1Password and I want to be sure that method that I use is secure. Main idea of the app is storing user passwords, and is protected with a global master password. Main ...
11
votes
2answers
2k views

Why does Signal repeatedly hash the secure passphrase?

Background: I'm working on creating a small program to extract my messages from Signal's newly-added (beta) encrypted backup feature. In the Signal codebase for their Android app, I noticed that ...
1
vote
0answers
163 views

HKDF to derive multiple keys from a strong constant master secret and a weaker changing secret

I am working with constrained nodes (type OpenMote CC2538) on a (constrained) 6TiSCH network and I am trying to design a good re-keying scheme designed to generate AES-128 keys dubbed Device ...
1
vote
0answers
210 views

Problems key AES 128 key from last round key

I have written an algorithm in Python to find the main AES 128 key from the last round key. However, it doesn't work; I can not find back my main key. I know that the general principle is to do $w[i] ...
4
votes
1answer
479 views

Why does NIST SP 800 `KDF in Counter Mode' specification require a PRF rather than a PRP?

This is the NIST SP 800 KDF in Counter Mode specification. Where $K_I$ is the input key, $[i]_2$ is the counter value, Label and Context are fixed-length strings and $[L]_2$ is the output size, the ...
4
votes
1answer
174 views

What is the reasoning behind the PRESENT key schedule?

It seems there are few books on PRESENT and even fewer that give any reasoning behind the mechanics of the key schedule. I understand how it works to the extent that I made a simple Excel program of ...
0
votes
0answers
73 views

Using OpenSSL to emulate LTO 4 tape encryption

I have a mix of LTO 4 and LTO 3 tapes I would like to encrypt data on to. LTO 4 has built in encryption - load they key into the drive, and it handles the AES-256-GCM encyption transparently. LTO 3 ...
3
votes
2answers
166 views

How can a hash function be suitable for hashing passwords, but not for deriving enctyption keys, and vice versa?

Not being a specialist in this field, I am nevertheless constantly trying to keep up with which methods are being considered secure for storing passwords and for encrypting data. During my research ...
2
votes
2answers
453 views

Attribute Authentication in Attribute Based Encryption (ABE)

When a data user requires access it asks the key issuer to generate a key for it using the specified attributes. How does the key issuer authenticate that the data user actually acquires the ...
0
votes
1answer
412 views

Web Crypto API - deriveKey vs. deriveBits? [closed]

I have some questions about deriveKey and deriveBits for web crypto API. I am confused about the state of these APIs. I do ...
5
votes
3answers
281 views

Anti-spamming hash-based proof-of-work?

I'm planning to implement a public mailbox for receiving feedback, and I'd like to use hash-based proof-of-work to frustrate spammers. First, we want to use 320-bit capacity Gimli permutation as the ...
1
vote
1answer
636 views

How to extract MAC and AES keys using x9.63 based kdf

For trying ECIES, I need to derive keys for MAC and AES from the shared secret using ANSI x9.63 based KDF. The information on key derivation I got it from Section 3.6.1 of http://www.secg.org/sec1-v2....
3
votes
1answer
307 views

How is the inter and the intra distance of a PUF calculated?

I was wondering, if I want to calculate the intra distance of a PUF, and I have already measured $n$ times a response to a challenge. Do I choose one reference value and compare the hamming distance ...
0
votes
1answer
1k views

Questions about future and session key generation in DUKPT process

As I understand this process is done in the client device for generating a unique key per transaction: inject generated IPEK to client device; generate set of future keys (actually 21 future keys) ...
3
votes
1answer
283 views

Double Ratchet Algorithm - What if the receiving wants to send the second message before the initiator?

I'm studying about Signal Protocol and I had a doubt in Double Ratchet Algorithm. This section describes how to derive the receiving and sending key messages. But in this scenario, only Alice can send ...
4
votes
1answer
405 views

Is the seed/salt input of a Key Derivation Function confidential?

I'm implementing a security protocol and for the key management a scheme is proposed using a key derivation function on the remote device. Thereby the input seed is uploaded in plaintext to the remote ...
0
votes
1answer
41 views

Use signed email as method for deriving encryption key

I'm trying to create a solution to decrypt a file at rest on a server by sending an email to a given address and receiving a reply from that address. I'm struggling to see if its possible and haven't ...
2
votes
1answer
90 views

Salt for non stored passwords

I read a lot about the concept of adding a salt to a password and understand that it protects against rainbow table etc. attacks. But this kind of attacks are based on getting access to the server ...
2
votes
1answer
110 views

Pepper and key derivation/stretching

I understand the pepper concept of adding but not storing a secret and iterating through the set of possible secret values for verifying. But is pepper also useful when it comes already to the use of ...