Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
4
votes
1answer
1k views

Can a raw ECDH shared secret be used directly for encryption?

If two parties calculate an ECDH shared secret can they (with no security weakness) use this raw value directly as an encryption key, assuming the underlying key and ECDH sizes match? Also the ...
1
vote
1answer
133 views

FHMQV-C \sigma calculation - Full Dual Exponential Challenge Response (FDCR) signature schemes-

I'm studying the protocol FHMQV - C but I don't understand how two honest parties can reach the same value of $\sigma$. The paper that I'm studying is: https://eprint.iacr.org/2009/408.pdf. If you ...
0
votes
1answer
290 views

Cryptographic notation in X3DH Key Agreement Protocol

Can someone please explain the below paragraphs from section 2.2 in The X3DH Key Agreement Protocol? Please try to explain the whole paragraphs. 1st paragraph: I want to understand how the DH ...
-2
votes
1answer
158 views

Help in decrypting this message: “e811339cf0258d2977fdefcd110c0e17daa5de81”? [closed]

Here are some details: I was given was a text that was converted into hexadecimal, then hashed via MD5, then hashed via SHA-1. That’s all I know about it. Any help is really appreciated. There is ...
7
votes
1answer
1k views

Why does LastPass hash their passwords with PBKDF2 this way?

LastPass is a password manager that I am sure many of you are familiar with. I have been studying LastPass's source code a bit. From their FAQs and what I can gather from their source code, the way ...
3
votes
1answer
467 views

Sequential public key generation with secret private keys?

So this is an idea that popped into my head the other day and I wonder if there are any known crytographic schemes with these properties? Is there a way to construct a public / private key system in ...
0
votes
1answer
65 views

Restricting symmetric key usage

I have a system where some clients communicate with a server. every client has its own name and role and some other parameters that sends these info to the server in every message and the server uses ...
1
vote
1answer
366 views

Is there a recommendation or standard for using SCRYPT as an unbounded length KDF and not a fixed length authentication hash?

How would I go about this? I don't want to roll my own but I do really want to use SCRYPT as a KDF for several algorithms, some of which require an output length longer than the SHA-256 hash. ...
13
votes
2answers
896 views

Can any block cipher in CTR mode be used as a CSPRNG?

I have been learning about block ciphers, modes of operations, and csprngs by myself for a few days and there are some things I'm unsure about. Assuming we only talk about cryptographically secure ...
1
vote
2answers
130 views

Should I use independent symmetric keys for each client should I use keys derived from a master key?

I have several clients that I communicate with from a central location. All connections are encrypted using static symmetric keys that are hard-coded in each client config file. I use a different key ...
1
vote
1answer
588 views

Is key derivation of a token shared secret necessary for usage of token in TOTP as specified by RF6238?

TL;DR: Is it necessary to generate a 'random' key from a shared token secret string before putting it into a TOTP algorithm that follows the RFC 6238 specification? Or is it okay for me to put the ...
7
votes
1answer
269 views

Key derivation after ECDH: why h(q ‖ pk1 ‖ pk2)?

I want to use the X25519 DH key agreement for generating a single AES-128 key. The distribution of the shared secret of such a key agreement is not uniform, so it shouldn't be used directly. The ...
1
vote
0answers
35 views

Shall I use individual or common signing keys for different roles?

I have a server S to which a client system can establish connections using predefined roles R1, R2, ...Rn. For mutal exchange of data and for authentication with GCM/GMAC a set of symmetric AES-128 ...
8
votes
1answer
258 views

Is a key ratchet effective against replay attacks?

In the answer to this question, a message counter is used to protect against replay attacks. Could a key ratchet be used instead? The basic idea is that with every message sent, the symmetric ...
2
votes
1answer
1k views

SHA-256 support for SecretKeyFactory in Java 6 and 7?

According to the following linked Java documentation, the relevant option for SecretKeyFactory algorithm (ignoring deprecated options involving MD5 or DES etc.) running in JRE 6 and JRE 7 is: ...
0
votes
1answer
163 views

Does mixing two derived keys make a stronger key? And if so, how would I mix?

I have to generated a secure key from some meta data and a password, and I'm free to choose among a dozen of key derivation functions (KDFs). The problem is, I'm not too happy with either one. Some ...
0
votes
1answer
80 views

Are there any downsides to key stretching an already high quality entropic key?

For example, if we grab 50 bytes from a high quality source and run them through a key stretching function like Argon2 and have it generate a 32 byte secret for AES. Is there any downside to this? Do ...
1
vote
2answers
126 views

P2P encryption - Do I need a different session key each time?

I am using AES128-CBC+HMAC for all encryption. Currently I am using the same encryption and authentication/MAC key (Both derived from a master key with HKDF). Assuming that forward secrecy is not a ...
3
votes
3answers
406 views

Use of PBKDF2 when no access to HKDF?

I would like to use a unique encryption key and authKey for each payload that I encrypt and authenticate via AES256 CBC with HMAC-SHA256. I'm considering the following: ...
4
votes
1answer
145 views

Is it secure to cascade KDFs

I would like to know if the following process to generate keys for a set of devices is secure. Let’s say I have a 128-bit master key MK with high entropy. I use a KDF to generate a 128-bit device key ...
3
votes
1answer
81 views

Deriving user keys from ID

The "normal idea" is to generate a key per user, send them to the users (securely, of course), and store them in a database. But what if I use a keyed hash (like Blake2b) with a server key and then ...
6
votes
1answer
529 views

Derivation of many (Key, IV) pairs from random 128 nonces and one secret 512 master key

The ext4 encryption system encrypt files with aes-256-xts. Each file uses two unique keys which are derived from a 512 bit master key and a per-file 128 bit nonce randomly generated when the file is ...
6
votes
2answers
226 views

FIPS 202/SHAKE: insecure 3DES key derivation example

I'm trying to understand the following passage from FIPS 202 (the SHA-3 standard), discussing the SHAKE functions' correlated outputs for different output lengths and the risks they induce in some ...
4
votes
1answer
381 views

KDF vs Stream Cipher

I was wondering why someone would go and use HKDF (or any KDF) when they can use a stream cipher instead. It seems like a stream cipher will always be one-way, whereas a KDF might not be (see AES or ...
1
vote
1answer
485 views

Is this symmetric key MAC-then-encrypt auth token methodology secure?

NOTE: This question originally conflated a "digital signature" and a "MAC", which I've since learned are not the same thing. Any references (in the answer or any comments) to a "signature" should be ...
2
votes
2answers
682 views

How to properly AES encrypt a string, deriving the key from the same string?

Let's say someone has a list of names, e.g.: 'Batman' 'Batman' 'Super Man' I am auditing this list, but I'm not allowed full access to all names. So they must be ...
10
votes
1answer
561 views

Can someone clarify two things about the HKDF by Krawczyk?

I got a question about the HKDF Scheme by Hugo Krawczyk. On the following link you can find a small explanation of the HKDF-Scheme and some short informations. The HKDF specification itself has been ...
1
vote
1answer
67 views

Special equivalent key in symmetric encryption

Let $k$ and $k'$ be two keys of symmetric encryption such that for some $m$ we have $ Enc_k(m)=Enc_{k'}(m)$. Is it possible to exist a plain text $m'$ such that $Enc_k(m') \neq Enc_{k'}(m')$. In fact,...
2
votes
1answer
360 views

How to securely combine multiple sources of entropy?

Suppose that I have $n$ secure 32-bit keys that were generated separately using methods that are known to be secure. For example, one of them might have been generated by using a proven CSPRNG. ...
5
votes
3answers
1k views

Derive a key from a password and another key?

I would like to encrypt some data using a password. I want to use a function like PBKDF2 to turn my password into a key. However, I would like to also require a keyfile, for added security. My data ...
-2
votes
2answers
310 views

Very simple, very memory-hard (?) password-based key derivation

I know the problem of memory-hard password-based key derivation functions is better left to the likes of scrypt, argon2, etc... But validated implementations of those algorithims are not always ...
3
votes
1answer
186 views

Cryptsetup | Given Enough Passphrase Entropy, Is It Necessary To Use a High Iteration Count?

Let's assume that, for creating a LUKS volume, I generate a random, 40 character passphrase that includes numbers, symbols, and upper and lower case letters, using the ...
13
votes
1answer
7k views

Is there any benefit from using SHA-512 over SHA-256 when AES just truncates it anyway?

I am still not very clear on how AES-256-CBC can use SHA-512 bit keys, but I assume that it just truncates the 512bit hash down to 256bit. In software like GnuPG and OpenPGP, is there any real benefit ...
11
votes
3answers
1k views

Is deriving the IV from the password secure?

I came across an encryption scheme to encrypt files with AES-256. You can see the initialization of the decryption routine below: ...
6
votes
2answers
1k views

Difference between RFC-5869 (HKDF) and SP800-108 (Nist's HMAC-based KDF spec)?

I'm trying to find the difference between the two aforementioned algorithms. It seems that one is either a subset of the other. Could someone explain the similarities/differences?
1
vote
1answer
183 views

What are the typical input lengths for KDFs?

I am looking for typical input lengths for key derivation functions like the HKDF. I know the parameters of HKDF, but can not find any information about typical input sizes to HKDF or any of the other ...
3
votes
1answer
737 views

What is the difference between KDFs for key derivation vs password stretching?

This was mentioned in the comments to another question: To clarify: This is about key-stretching KDFs. Not the kind for diversifying keys (eg. HKDF) and There are two kinds of KDF, the slow, ...
0
votes
1answer
63 views

Key Prefix KDF with Counter

I don't want to discuss the security problem with MD-based hashfunctions when using them as KDF. Since the existence of SHA3 or Skein hashfunction it is possible to use them as key prefix KDF. What I ...
3
votes
1answer
61 views

Desirable Property of Block Sub-Keys

What is the more desirable for a block cipher's sub-keys ? Given two blocks ciphers, letting all other properties be equal (they have the same strength), the only difference between them is that: ...
2
votes
1answer
101 views

Is there an algorithm to derive a 1-of-N shared secret from a set of N private keys?

This is different from Shamir's Secret Sharing in that we are starting with the keys and deriving a shared secret, rather than the other way around. Let me be more precise: We are given keys $k_1, \...
7
votes
2answers
16k views

Key derivation functions (KDF): What are? Main purposes? How can they be used?

What are KDFs? What are their main purposes? How they can be used, in other words, what's their drill in a cryptography scheme?
13
votes
3answers
796 views

Is it better to maximize memory usage or number of passes with Argon2i 1.3?

I wrote a small application that uses Argon2i for deriving symmetric keys for encryption of local files and secret Curve25519 keys. Argon2i v1.3 is susceptible to TMTO attacks if the number of passes ...
1
vote
1answer
253 views

PKCS12 key derivation

In older versions of PKCS#12 there was a key derivation function that, near as I can tell, isn't used anywhere outside of that standard: https://tools.ietf.org/html/rfc7292#appendix-B That discusses ...
2
votes
0answers
2k views

What is the use of key iterations?

I read about PBKDF2 on Wikipedia and seen few apps. having option to manually enter number of iterations. I am still not clear on this. (1) With what I understood, key iterations can be used only ...
1
vote
0answers
45 views

Using multiple iterations of Argon2i

Consider Argon2i used as a key derivation function (implemented by the libsodium crypto library) to derive an encryption key from a password. Additionally, when entering the password a second time, ...
13
votes
3answers
7k views

How many KDF rounds for an SSH key?

What is the best practice on choosing how many key derivation function (KDF) rounds/iterations when generating an SSH key pair with ssh-keygen? Am I correct in saying that it is unnecessary if the ...
2
votes
1answer
93 views

Using only pseudorandom function to drive many deterministic keys

My question is related to: Can Pseudorandom values be used as secure keys? But here I'm only using pseudorandom function. Assume we have a pseudorandom function, $PRF$. We have a truly random ...
6
votes
1answer
416 views

Ephemeral Encryption Keys

My understanding is, ignoring implementation details, iOS disk encryption works like this: On boot (and/or every time you unlock your phone) an ephemeral session key is created that can decrypt ...
1
vote
3answers
159 views

Function to derive an integer from a given password

I need to get an int, derived by a given password, to feed it to a deterministic PRNG as a seed. The derived int should not give away any clues about the password. How can I achieve this without ...
2
votes
1answer
690 views

AES vs AES-CMAC for session key derivation

Assume two parties have exchanged a secret 128-bit Master Key, MK. When the two parties want to communicate, one of them generates a random 128-bit value, R, which is then sent in plaintext to the ...