Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
2
votes
1answer
110 views

Pepper and key derivation/stretching

I understand the pepper concept of adding but not storing a secret and iterating through the set of possible secret values for verifying. But is pepper also useful when it comes already to the use of ...
1
vote
1answer
434 views

Can I use a random number generator with seed for key derivation?

I don't know a thing about cryptography so I'm judging by what I see in APIs docs. I want to use ECDSA or ECDH in my project. And what I know so far about key derivation in this systems is that they: ...
0
votes
1answer
184 views

Generating 1024 bits of entropy from a seed

I need to generate 1024 pseudo-random bits from a 100 bytes string seed (only valid lowercase chars) One thing I'm pretty sure would be secure enough would be to repeat this 100 bytes string 20 times ...
4
votes
1answer
64 views

Key Derivation Functions offering better than 2^hlen security?

On page 21 of his HKDF paper, Krawczyk criticized one of the stated desirable features of KDFs from the paper “On The Security of Key Derivation Functions” (Emphasis mine): Due to the way the hash ...
3
votes
1answer
507 views

Is it secure to use so many iterations of AES-CBC as a KDF so that it's slow even using AES-NI?

Note: This is not the same as Multiple iterations of AES for key derivation?. Almost everyone has AES-NI nowadays - when building a cryptographic application, is is possible to leverage this to ...
1
vote
0answers
820 views

DUKPT MAC Variant key [closed]

I'm currently implementing an interface that makes use of the DUKPT (Derived Unique Key Per Transaction) scheme to generate MAC keys. This particular interface uses a different (variant) of the MAC ...
0
votes
1answer
284 views

What operation does $\|$ denote in ANSI X9.63 KDF? [duplicate]

Can someone tell me in laymens terms what this is? $$K_i = \mathrm{Hash}(Z \| \mathit{Counter} \| [\mathit{SharedInfo}])$$ What do the double pipes represent?
5
votes
2answers
2k views

Why does openssl derive IVs from a password?

From https://wiki.openssl.org/index.php/Manual:Enc(1): When a password is being specified using one of the other options, the IV is generated from this password. Why does OpenSSL do this? My ...
3
votes
1answer
182 views

Necessary to authenticate nonce if authentication-key is derived from nonce?

Lets suppose my messages are composed like this: unique_message_nonce + encrypted_message + mac Because I don't have an AEAD-scheme, I can encrypt and authenticate ...
-1
votes
1answer
428 views

Key Derivation Function (KDF) Usage [closed]

Is it common to have a KDF implementation in order to safely store passwords? Do IT-companies use KDF? Or do they usually rely on other algorithms? If you have any practical example for the second ...
4
votes
2answers
227 views

Can we have single hash function both for data integrity and key derivation function?

Can we have single hash function both for data integrity and key derivation function? Why and Why not? Any link describing difference analytically will be appreciated. Thanks.
4
votes
1answer
1k views

Clarification needed in TLS 1.2 key derivation process

Reference to TLS 1.2 standard documentation section 6.3 regarding the key generation here: To generate the key material, compute ...
1
vote
1answer
947 views

The number of keys generated in TLS 1.2?

In section 6.3. Key Calculation in the standard documentation here, I see the following: The master secret is expanded into a sequence of secure bytes, which is then split to a client write MAC ...
3
votes
1answer
241 views

Does it matter whether the KDF salt is integrity protected?

I am writing a simple application, mainly as a fun challenge, but also to hopefully someday use as my password manager. I'm using pynacl's SecretBox, which ...
9
votes
1answer
3k views

argon2 vs scrypt

It's a fact that scrypt and argon2 are the two dominant memory hard KDFs. But which one of them is more recommendable for password hashing? scrypt is older and as far as I know resistant to almost ...
4
votes
3answers
2k views

How likely is a AES KDF bypass?

So I was wondering about some alternative attack scenario which I thought of when I started to understand KDF's . So lets say you have a cipher like AES and a strong KDF . And the legit user uses a ...
5
votes
1answer
457 views

Use RSA keys to derive AES key

I have 2 end points where I would like to derive the same AES key. Every end point has its own RSA key pair and RSA public key from the other end point, and I would like to combine them somehow on ...
1
vote
2answers
351 views

how does hkdf generate 2 keys?

Hi I am new to cryptography and am confused as to how HKDF generates two separate keys from one single key/password. Is it as follows? Key 1: HKDF-Extract(salt, IKM) -> PRK Key 2: HKDF-Expand(PRK, ...
5
votes
2answers
4k views

Looking at hash output – is Base64 encoding in any way better than HEX encoding?

I was wondering why most "normal/unsafe" crypto hashes like SHA-256, SHA-512, Whirlpool, RipeMD-160, MD5, etc. are HEX encoded. But most "secure" crypto hashes (KDF' ) like ...
1
vote
1answer
255 views

PKCS #11 – Deriving a Key where MSB perform encryption and LSB perform CMAC operation?

I am using Thales HSM, a PKCS #11 Compliant device. I have an 32 byte AES key and derivation input. I want to use AES-ECB encryption Mode to derive a 32 byte key where 16 MSB should be considered as ...
4
votes
1answer
546 views

Some Questions about the Veracrypt hash functions

Veracrypt has always been my favourite encryption tool since it came out . But still there are some things about the tool I don't understand . Why is there the possibility to use sha256 or sha512 . ...
1
vote
1answer
860 views

What is meant by “KDF2” vs “PBKDF2”?

I see many references to KDF2 here, but all links are broken and Wikipedia does not have an entry for KDF2. Is KDF2 a specific standard for Key Derivation without a password? Ultimately, I am trying ...
1
vote
1answer
36 views

how can I draw from a set of characters using a seed for entropy?

Given a seed string S, I want to deterministically generate a password of the form: N characters, each chosen from a set of characters C Unfortunately neither N nor the cardinality of C necessarily ...
5
votes
2answers
2k views

Is SHA 2 suitable for key derivation?

Let's imagine that I've got a number modulo n given by DH protocol. I want to use it as a key for AES encryption. So I have to cut this number to fit it in AES (...
5
votes
2answers
2k views

Derive a secret from an RSA private key

What I want to do is deterministically derive a secure key from an RSA private key, such that the RSA private key cannot be derived from the secure key. The first approach that came to mind was ...
4
votes
1answer
2k views

Questions about the argon2 options

So because I am currently working on a Project in which I will use Argon2 I need some answers to questions about the options of Argon2. I didn't find anything about them. What exactly does the ...
2
votes
1answer
372 views

What is the key derivation function used in GnuPG, and how long may its input be?

I am currently working with GnuPG on a new project of mine. It would be very useful to know two things for that, which are not described in the manual: What is the maximum input size of a symmetric ...
7
votes
2answers
1k views

What exactly does s2k do in gpg

So I recently discovered the --s2k mode in gpg. Sadly it is not very well-documented. I mean, what is ...
18
votes
0answers
575 views

Memory-hard password hash in practice?

Dan Boneh, Henry Corrigan-Gibbs, and Stuart Schechter have proposed Balloon Hashing: A Memory-Hard Function Providing Provable Protection Against Sequential Attacks (in proceedings of AsiaCrypt 2016). ...
3
votes
2answers
694 views

For encryption with a passphrase, should you re-use the same salt for key generation?

Let's say I have a simple "vault" application where users can enter data and a passphrase, and it will be encrypted, requiring them to re-enter the passphrase to decrypt it. This would be implemented ...
3
votes
1answer
103 views

Is there a KDF that can be computed in an untrusted environment?

I'm looking for a Key Derivation Function, kind of like PBKDF2 or Scrypt, but which can be computed by a machine you don't trust. Some way to give it a derivative of the source password, such that ...
1
vote
1answer
120 views

Do PBKDF2 keys generated at a lower iteration count leak information?

Assume the threat model here is that the server is not to be trusted and the client is trusted. A user registers for an account and the client chooses an iteration count of 50,000 to generate a 512 ...
5
votes
2answers
5k views

Why are ephemeral/session/temporary keys useful?

One reason that communication protocols use ephemeral keys is to help with implementing Perfect Forward Security. They're also used in SSL to go from using RSA to using a faster symmetric encryption. ...
1
vote
1answer
178 views

Can key-wrapping help to securely change passphrase used to generate encryption key?

I am working on financial application where users' data are encrypted with symmetric cipher (AES-256), encryption keys is derived with KDF from user's password. I am looking for way how to give to my ...
0
votes
1answer
50 views

Formal Information-Theoretic Key Expansion Definition

Is there a formal definition for a protocol that expands keys that are pre-shared among 2 or more parties? How about an informal definition? Example: Alice and Bob pre-share a $n$-bit string $k$. ...
6
votes
3answers
954 views

Blake2B as a KDF

How would one go about using vanilla keyed Blake2B as a KDF with high-entropy inputs. Assume I don't have access to more specialized algorithms such blake2XB, HKDF, etc. Salt - high entropy per-...
5
votes
1answer
1k views

Argon2i versus Argon2d?

I am planning to use Argon2 in my Android app to encrypt some sensitive info that is only stored on the user's phone (in an SQLite DB) and not exported anywhere else. From documentation I see that ...
4
votes
1answer
1k views

Can a raw ECDH shared secret be used directly for encryption?

If two parties calculate an ECDH shared secret can they (with no security weakness) use this raw value directly as an encryption key, assuming the underlying key and ECDH sizes match? Also the ...
1
vote
1answer
130 views

FHMQV-C \sigma calculation - Full Dual Exponential Challenge Response (FDCR) signature schemes-

I'm studying the protocol FHMQV - C but I don't understand how two honest parties can reach the same value of $\sigma$. The paper that I'm studying is: https://eprint.iacr.org/2009/408.pdf. If you ...
0
votes
1answer
277 views

Cryptographic notation in X3DH Key Agreement Protocol

Can someone please explain the below paragraphs from section 2.2 in The X3DH Key Agreement Protocol? Please try to explain the whole paragraphs. 1st paragraph: I want to understand how the DH ...
-2
votes
1answer
157 views

Help in decrypting this message: “e811339cf0258d2977fdefcd110c0e17daa5de81”? [closed]

Here are some details: I was given was a text that was converted into hexadecimal, then hashed via MD5, then hashed via SHA-1. That’s all I know about it. Any help is really appreciated. There is ...
7
votes
1answer
1k views

Why does LastPass hash their passwords with PBKDF2 this way?

LastPass is a password manager that I am sure many of you are familiar with. I have been studying LastPass's source code a bit. From their FAQs and what I can gather from their source code, the way ...
3
votes
1answer
446 views

Sequential public key generation with secret private keys?

So this is an idea that popped into my head the other day and I wonder if there are any known crytographic schemes with these properties? Is there a way to construct a public / private key system in ...
0
votes
1answer
63 views

Restricting symmetric key usage

I have a system where some clients communicate with a server. every client has its own name and role and some other parameters that sends these info to the server in every message and the server uses ...
1
vote
1answer
334 views

Is there a recommendation or standard for using SCRYPT as an unbounded length KDF and not a fixed length authentication hash?

How would I go about this? I don't want to roll my own but I do really want to use SCRYPT as a KDF for several algorithms, some of which require an output length longer than the SHA-256 hash. ...
13
votes
2answers
871 views

Can any block cipher in CTR mode be used as a CSPRNG?

I have been learning about block ciphers, modes of operations, and csprngs by myself for a few days and there are some things I'm unsure about. Assuming we only talk about cryptographically secure ...
1
vote
2answers
125 views

Should I use independent symmetric keys for each client should I use keys derived from a master key?

I have several clients that I communicate with from a central location. All connections are encrypted using static symmetric keys that are hard-coded in each client config file. I use a different key ...
1
vote
1answer
557 views

Is key derivation of a token shared secret necessary for usage of token in TOTP as specified by RF6238?

TL;DR: Is it necessary to generate a 'random' key from a shared token secret string before putting it into a TOTP algorithm that follows the RFC 6238 specification? Or is it okay for me to put the ...
6
votes
1answer
253 views

Key derivation after ECDH: why h(q ‖ pk1 ‖ pk2)?

I want to use the X25519 DH key agreement for generating a single AES-128 key. The distribution of the shared secret of such a key agreement is not uniform, so it shouldn't be used directly. The ...
1
vote
0answers
35 views

Shall I use individual or common signing keys for different roles?

I have a server S to which a client system can establish connections using predefined roles R1, R2, ...Rn. For mutal exchange of data and for authentication with GCM/GMAC a set of symmetric AES-128 ...