Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
3
votes
2answers
372 views

KDF Salt: How/When is it Okay for it to be public?

Post Structure: Prior source material studied Question & Details Assumed threat model Example Assumptions Clarifications Prior source material studied 0.1. RFC 2898 0.2. HAC (Handbook of ...
1
vote
1answer
64 views

A feasible approach for AEAD on an ethernet link?

The setup is shortly this: There are two custom switches (think of an FPGA for example), both are handling 10-100 Gb/s orders of traffic from their outside facing interfaces. This is normal traffic. ...
3
votes
1answer
272 views

Reasonable Password Entropy given a certain Set of argon2 Parameters

I followed the recommendation of choosing threads, memory consumption and the number of iterations (in that order) on my machine. But now I wonder which passwords (by means of entropy) are actually ...
10
votes
2answers
2k views

Why do some key derivation functions (like PBKDF2) use a salt?

Let me start by explaining my understanding of the various concepts involved in this question: Salt: Random bytes of data used as secondary input for a password hashing function, like so: ...
5
votes
1answer
143 views

Login security and plaintext of a password stored in Argon2i to derive a key via halite safe?

I'm using Symfony 4. I have set parameters on all my Argon2 stuff below so that it takes 1s per iteration. This website is supposed to encrypt HIPAA information. Basically I have a table like this <...
1
vote
1answer
411 views

Key generation for AES-GCM-256 file encryption

I am currently working on a file encryption software that works via AES-GCM-256 and I am looking for feedback on the encryption key generation process I intend to implement. So far, I have come up ...
2
votes
0answers
40 views

Use derived keying material as key for stream cipher

Section 7.3 of SP 800-108: To comply with this Recommendation, the derived keying material shall not be used as a key stream for a stream cipher. Footnote: The level of security provided by ...
1
vote
1answer
70 views

Why use a date-dependent substring of a pre-shared key instead of just the key?

I've recently come across a situation where one system passes an encrypted payload to another system. The payload is encrypted using a pre-shared key. However, instead of just using the key itself, a ...
3
votes
1answer
179 views

Key derivation: Does it make sense to use KDF and PRF consecutively?

I'm in a project, where the output of a Key Agreement algorithm (uses ECC) is used as input for a KDF, and the output of the KDF (X9.63 KDF) is consecutively used as input for a PRF (CMAC) to ...
1
vote
0answers
83 views

Is there hierarchical key generation that completely tolerates leakage?

Is there a hierarchical key construction algorithm that achieves forward/backward privacy with any (unlimited) leakage of private non-master keys? What I mean is that if there's an unbounded number ...
3
votes
2answers
67 views

How is formal analysis of the strength of a round achieved?

I've been trying to understand how the number of rounds are picked for ciphers. There seems to be a minimum number of rounds that is analyzed for "strength" and then some security margin is added. ...
0
votes
1answer
80 views

How do i generate the shared key from this question?

Say I have Alice and Bob: Alice has $XA$, $YA = g^{XA} \bmod P$, $RA$ (random number) Bob has $XB$, $YB = g^{XB} \bmod P$, $RB$ (random number) Assume they have exchanged their certificates and ...
1
vote
1answer
97 views

Doubts regarding implementing AES-128 bit algorithm in my IOT system

I want to implement AES-128 in my IoT network which consists of a Master device which runs Linux on it and slave devices which are 8-bit micro-controllers that periodically transmit data packets to ...
2
votes
0answers
55 views

Key update and re-keying

What is the exact difference between the key update and re-keying? Following the discussions here, I understood that the key update is the process of deriving the new session key from old key. In the ...
1
vote
2answers
402 views

In RSA, is it possible to compute the private key if one knows one of the primes used to generate n?

Within RSA the private key can be derived if one knows both $p$ and $q$. Is it possible to derive the RSA private key or decrypt / learn something about encrypted messages if you only know one of the ...
2
votes
0answers
213 views

Revoke a GPG key using previously generated revoke certificate after renewd (change expiration date)

I have few sub-questions Do secret keys get expired, or just the public key gets expired? Do I have to back up the master sec key each time I renew it? For an ...
0
votes
1answer
248 views

Good practices for AES key derivation and management

I'm developping a device based on STM32L4x6. It is connected through BLE to a smartphone and it exchanges encrypted data with it. Data consists of health data of patients. Encryption is AES-GCM 256 ...
1
vote
0answers
146 views

Securing MQTT communication

I am building kinda simple IoT project, but I would like to implement good security (just for educational purposes and fun). My plan is to build simple solution where one arduino board reads some data ...
0
votes
1answer
67 views

correct a corrupted shared key

Suppose we have an almost shared secret. For example if we have a noisy connection to a shared secret source of randomness. So Alice has $k_1$ and Bob has $k_2$ similar but not necessarily identical ...
3
votes
1answer
354 views

Turn a password into a key without using salt

Assume I have a password with sufficient entropy but may not be uniformly distributed, how can I turn the password into a key that can be used for symmetric encryption? I think there is surely such a ...
4
votes
3answers
616 views

Generate 2 independent keys from a master key

The scenario is like this: I need 2 keys for different purposes (encryption + encryption, encryption + mac, or whatever). Because it is not good practice to reuse the same key, I'd like the 2 keys to ...
2
votes
0answers
482 views

Curve25519 / Ed25519 - Generate a private key from this term

I have 2 key pairs $(x_1, y_1)$, $(x_2, y_2)$. I also have $a = $random 256-bit array and $b = $256-bit of defined values from me. I know the values for $(x_1, y_1)$, $x_2$ and $b$. But I miss the ...
2
votes
2answers
163 views

Why is it recommended to hash passwords with a secret salt?

NIST recommends doing an additional round of hashing using a secret salt: In addition, verifiers SHOULD perform an additional iteration of a key derivation function using a salt value that is ...
1
vote
1answer
55 views

Why the output length of a KDF should be the same as the underlying OWF?

Quote: The chosen output length of the key derivation function SHOULD be the same as the length of the underlying one-way function output. Could someone please help explain the benefits and ...
2
votes
0answers
75 views

Sharing salt for deterministic symmetric key derivation

I have a requirement to generate and share unique symmetric keys for a large numbers of small data objects. In many cases the storage and retrieval of the key for each object will be a significant ...
5
votes
2answers
222 views

Are PBKDF2 derived keys related if only the number of iterations is changed?

I'd like to encrypt my disk with a password. To generate a nice key from a password, I used PBKDF2, which applies a hash function $k$ times to a cleartext and outputs the final result. When I ...
1
vote
2answers
515 views

Relationship between PRF/KDF/MAC?

It seems that not every MAC is a KDF. But would any PRF also work as both KDF and MAC? Could someone explain the relationship between these 3 definitions?
1
vote
0answers
53 views

Question on inputs of PRFs and HKDF KDF

I've read a lot of information about PRNGs, PRFs and KDFs. As far as I know: PRNG: The seed for the PRNG must be a uniform string. It transforms a short real uniform string into some bits of pseudo-...
3
votes
1answer
100 views

Block cipher birthday bound and a KDF workaround

Can the birthday bound arising from a block cipher’s block size be worked around by deriving different keys from the master key with a KBKDF using a tweak? For example consider the following scheme, ...
2
votes
1answer
491 views

HMAC SHA256 for deriving session keys using random nonce

I need to derive session key in order to create an application layer secure channel between mobile app and a bluetooth device. My scheme is similar to this scheme that uses a HMAC and counter. ...
1
vote
1answer
196 views

derive child keys from a private key

My problem is the following: I have an organization with many members. When someone from the outside communicates with this organization, I want any member to be able to decrypt the communication. ...
5
votes
1answer
522 views

Is it problematic to use PBKDF2-HMAC-SHA256 to derive a 512-bit XTS key?

PBKDF2 should only be used to generate a larger output than the hash function it uses if the output is used in such a way that it has a flat keyspace. As far as I am aware, XTS does not have a flat ...
2
votes
1answer
63 views

Reveal all information up to n-th message

Is there a way to generate a sequence of keys that have the property that exposing any of those keys will reveal all previous keys, but no future key? I'm thinking about an application that sends an ...
0
votes
2answers
449 views

Multiple key generator

I need an algorithm for "key generator". It should be initialized with some secret data, such as a (hashed) passphrase, or something generated once by some 3rd-party code. Given some small input it ...
1
vote
1answer
41 views

Encryption program conseil

I'm writing a little program to encrypt and decrypt a file. I'm using AES encryption in CTR mode that takes a key generated by a KDF (script). I have read some articles about cryptography but I have ...
1
vote
0answers
50 views

Time-sensitive key derivation for sharing with third-party

Devices: In this system, users have one or more wearable devices (a smart watch), one of which they will most likely have on their person all the time. The devices are linked to their account by their ...
3
votes
1answer
376 views

Combining multiple cryptographic keys to generate an encryption key

We have a system that has several SecretKeys (for example, one for a user, and one for us). We want to encrypt data in a way that requires all of those keys to be available in order to decrypt. I ...
3
votes
2answers
303 views

Using HKDF to derive symmetric keys from a hybrid public-key encryption scheme

RFC 5869 describes HMAC-based Extract-and-Expand Key Derivation Function (HKDF). In section 4, entitled "Applications of HKDF", it states that one of the intended uses is: derivation of symmetric ...
0
votes
1answer
99 views

is it safe to leak some information about scrypt result?

I am encrypting a file via AES-CBC and am using scrypt to extract a key from a user-provided password. The IV is public and is stored with the encrypted file. Is it safe to generate my IV (public) ...
-4
votes
1answer
91 views

How to reversely compute from hash [closed]

What are practical methodologies to derive the following ciphertext: 1bd0d370b262d748b21c40cc7e5746642b4c06079a224c65e443e429289753c2
2
votes
0answers
85 views

Can proofs be relayed to derived keys?

I am aiming to find out if this problem/puzzle can be solved with cryptography at all. Say there are these two parties: Subject S which has a master private/public key pair (MPriv, MPub) and a set of ...
4
votes
1answer
428 views

How secure is using a hash function as Key Derivation Function?

I am developing a personal project and I have the following need: given a randomly generated seed (with enough entropy) I need to generate a number $x$ of Ed25519 key pairs. These key pairs are not ...
2
votes
1answer
80 views

Can private key be specified on key pair creation?

Without regards to any specific implementation of asymmetric cryptography, I am wondering if it is feasible to come up with a value of private key I want to use, and calculate the corresponding public ...
2
votes
0answers
64 views

Did “The Catena Password-Scrambling Framework” make an error in the reduction of its pseudorandomness?

I was reviewing the most recent version of the Catena paper and they made some claims that I find questionable in their reduction of the pseudorandomness of the output of Catena (p. 32). First I will ...
4
votes
1answer
107 views

PBKDF security if all but one keys are exposed

I'm trying to understand the security of KDF but stuck with PBKDF case (case 3). Suppose, we have the following settings: $KDF(SK,salt_1) \rightarrow k_1$ $KDF(SK,salt_2) \rightarrow k_2$ The ...
2
votes
0answers
267 views

The right way to encrypt sensitive data with an user password

I am developing something like 1Password and I want to be sure that method that I use is secure. Main idea of the app is storing user passwords, and is protected with a global master password. Main ...
11
votes
2answers
2k views

Why does Signal repeatedly hash the secure passphrase?

Background: I'm working on creating a small program to extract my messages from Signal's newly-added (beta) encrypted backup feature. In the Signal codebase for their Android app, I noticed that ...
1
vote
0answers
170 views

HKDF to derive multiple keys from a strong constant master secret and a weaker changing secret

I am working with constrained nodes (type OpenMote CC2538) on a (constrained) 6TiSCH network and I am trying to design a good re-keying scheme designed to generate AES-128 keys dubbed Device ...
1
vote
0answers
225 views

Problems key AES 128 key from last round key

I have written an algorithm in Python to find the main AES 128 key from the last round key. However, it doesn't work; I can not find back my main key. I know that the general principle is to do $w[i] ...
4
votes
1answer
555 views

Why does NIST SP 800 `KDF in Counter Mode' specification require a PRF rather than a PRP?

This is the NIST SP 800 KDF in Counter Mode specification. Where $K_I$ is the input key, $[i]_2$ is the counter value, Label and Context are fixed-length strings and $[L]_2$ is the output size, the ...