Skip to main content

Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
1 vote
1 answer
815 views

Station-to-Station protocol questions

Basic Station-to-Station protocol which authenticates Bob and Alice if they safely shared their long-term asymmetric public keys. Alice sends Bob her public key $A_K$ Bob receives $A_K$ and computes ...
civ15's user avatar
  • 117
1 vote
0 answers
76 views

RSA Modulus doesn't match the primes [closed]

I generated a 2048-bit RSA key with ssh-keygen. When running: openssl rsa -in key -noout -text The result is: ...
jbal's user avatar
  • 11
0 votes
1 answer
377 views

Security implications of using a high entropy password with a low iteration count for a key derivation function

This question is related to my other question, but also this entropy calculation question as well as this article about PBKDF2. It may also be considered as a duplicate of this question, although in ...
Dash's user avatar
  • 95
9 votes
2 answers
888 views

Key derivation on Arduino

The ATmega2560 is slow - it's a single core, 16MHz 8-bit AVR. Despite that, I need to use some encryption on it, and since it is limited to a few blocks, AES-256 can be used. However, the key ...
Dash's user avatar
  • 95
8 votes
2 answers
7k views

Why cryptsetup default KDF is PBKDF2 and not Argon2(id)?

I plan to do a clean install of ArchLinux with Full Disk Encryption (with LUKS) but I'm not sure to understand the default KDF choice (PBKDF2+SHA-256). I didn't manage to find any pieces of evidence ...
Rand0mMan's user avatar
  • 223
0 votes
0 answers
37 views

Rekeying procedure - how "far" from bijection?

Imagine that I want to change the key in order to prevent side-channel attacks on key and to protect against big load on the one key. It is desirable that key change procedure would look like random ...
Kirill Tsar.'s user avatar
2 votes
2 answers
301 views

Optimal memory-hard KDF parameters when faced with small, slow memory

I am developing for a low-power embedded system. It has two ARM9 processors at 48 MHz each. One of the processors has access to 6 MiB of "fast" memory as well as access to 26 MiB of "...
forest's user avatar
  • 15.3k
4 votes
3 answers
1k views

Should we run PBKDF2 for every plaintext to be protected or should we run PBKDF2 only once?

I am going to store secrets from users. The secrets need to be stored confidentially. For this question, I am concerned only with confidentiality (not integrity). Here is how my encryption scheme is: ...
Lone Learner's user avatar
32 votes
6 answers
5k views

What is the practical impact of using System.Random which is not cryptographically random?

I recently noticed a .NET software using PBKDF to derive an encryption key from a password string. This password string was ...
learnerX's user avatar
  • 687
7 votes
6 answers
7k views

Use a SHA256 as a key for AES256

Is it safe to use the SHA256 of a hard-to-bruteforce string as the key to encrypt data with AES256?
xaoc2nd's user avatar
  • 73
2 votes
1 answer
264 views

What is a randomly derived key?

It is a well-known fact that using the same key + nonce combination with a stream cipher twice breaks security. The NaCl library has different primitives for authenticated encryption (i.e., ...
Zaphod's user avatar
  • 55
3 votes
1 answer
225 views

Are two keys derived from the same password vulnerable to a related key attack?

Background I am currently writing a password manager application. As usual, the passwords are put in a file encrypted using a user-entered password. I'm using the NaCl library but actually it's not ...
Zaphod's user avatar
  • 55
1 vote
2 answers
133 views

"Dave Check" for a tweakable P-256 ECDH KDF

I have two devices with hardware tokens that contain P-256 private keys, and which allow me to compute ECDH shared secrets with arbitrary public keys. I need to build a tweakable key derivation ...
Reid Rankin's user avatar
3 votes
1 answer
898 views

Is it safe to reuse the salt for generating symmetric keys for a chat application?

I'm writing a program that allows two users to communicate over E2E encrypted chat with a secret they have agreed upon in the past. The process works as follows: A key is derived from the secret ...
zooweemama's user avatar
2 votes
1 answer
239 views

AES key schedule. Does it use a KDF to generate the round keys?

So for each round in AES a different key is used, and as I saw the keys are created form a master key. My question is how these round keys are generated. Are they created via a Key Derivation ...
user67441's user avatar
0 votes
0 answers
51 views

Are two halves of PBKDF output "related" [duplicate]

In other words, in the context of authenticated encryption using Encrypt-Then-MAC, is this stupid?: ...
vezult's user avatar
  • 131
0 votes
0 answers
286 views

Generating the Backup Exec AES-256 GCM key used to encrypt/decrypt LTO5 tape drive data

I've got an LTO5 tape that was backed up using Backup Exec (BE), which used hardware compression when writing to the tape. I've been given the passphrase that BE used to create the actual encryption ...
GeoLIb's user avatar
  • 1
1 vote
0 answers
223 views

I need to send 16 bytes using ECC keys on a resource-constrained device

I have a system where a resource-constrained device has to send 16 bytes. It has its ECC key pair, and a peer's Public ECC Key. We're using the p256 curve. The device also has an AES-128 hardware ...
Sarkreth's user avatar
  • 203
1 vote
1 answer
590 views

Can you derive a 128 bit AES encryption key using PBKDF2 with SHA-256

I got confused about key derivation functions. For my project, I need to derive a 128 bits AES encryption key in CTR mode. To do so, I'm using a PBKDF2 to derive this encryption key using an initial ...
Ahmet Eroğlu's user avatar
4 votes
2 answers
849 views

Bluetooth Low Energy: Key generation

I'm studying the BT core spec v5.1 to understand the security features and how everything fits together. I am looking at Secure Connections for now. In the field "Key generation" it says it uses P-...
Martin Aa S's user avatar
1 vote
2 answers
76 views

Derive operations from an arbitrary number

I don't really know how to phrase this question, so I'll just mention the idea. This is partially reminiscent (at least in spirit to white box crypto): Can one derive arithmetic operations from a ...
jimmytann's user avatar
  • 177
1 vote
1 answer
174 views

how are variable key sizes produced?

I am current learning the internal working of several Symmetric key Cryptographic algorithms, and came across DES and AES. DES takes in input a 64 bit key and AES-128 takes in input a 128 bit key ...
Vasu Deo.S's user avatar
8 votes
2 answers
951 views

Do you really need a KDF when you have a PRF?

My understanding is that a KDF is like a PRF, except that it has a preliminary step that "extract" entropy. It is thus needed when the entropy is non-uniform (for example the output of ECDH is modulo ...
David 天宇 Wong's user avatar
3 votes
2 answers
389 views

Hashing a hash for authentication

I currently use Argon2 to derive a key (I will use a salt which I will save in a file as plaintext for when I later need to derive a key again) from a given password which I will use to encrypt a file ...
OughtToPrevail's user avatar
9 votes
2 answers
5k views

Key Derivation Functions vs. Password Hashing Schemes

Key derivation functions, such as HKDF (standardized in RFC 5869), are meant to stretch some initial keying material having enough entropy, like a Diffie-Hellman shared value, into one or more strong ...
cryptopathe's user avatar
  • 1,185
2 votes
2 answers
1k views

PBKDF and Entropy

We all regularly use password based, key derivation functions, however something that strikes me as counter intuitive is how PBKDF can somehow "stretch" the entropy of a supplied password to generate ...
Woodstock's user avatar
  • 1,424
1 vote
1 answer
2k views

Is the KDF pbkdf2 included in the openssl suite? [closed]

I'm trying to encrypt a file using DES in CBC mode but when I try to specify the key derivation function it tells me my command is wrong. It only fails when I try specify the KDF and works when I don'...
Hamish's user avatar
  • 13
0 votes
2 answers
101 views

Can modern password hashing functions mathematically exclude parallel computation?

A recent password hashing competition set out the following detailed technical requirement:- that the API should include, but may not be limited to, a function with the following prototype: <...
Paul Uszak's user avatar
  • 15.5k
1 vote
1 answer
276 views

Signal Protocol - Counter over TCP?

Signal Protocol uses a counter (discussed in DoubleRatchet documentation) to define how many times KDF has derived a new key (aka a KDF step) which is then sent along with every message for the end ...
OughtToPrevail's user avatar
3 votes
1 answer
447 views

How will be cipher selected when client is running on version TLS 1.3 and server is running on TLS 1.2?

How will be cipher selected when a client is running on version TLS 1.3 and server is running on TLS 1.2? The cipher list provided by TLS 1.3 client will be different than the version supported on ...
rakesh sharma's user avatar
1 vote
0 answers
141 views

How to implement correctly a "secure" authentication protocol? [closed]

Due to my lack of knowledge in this matter I am facing some problems to identify which features are sign of a bad implementation of a symmetric authorization application. As I am concerned the system ...
user67441's user avatar
3 votes
1 answer
134 views

What key is used to encrypt the certificate and certificate verify message in TLS1.3?

Which key is used to encrypt certificate and certificate verify message in TLS1.3? I could not figure out which one it is reading section 4.4.2 of RFC 8846 and I only saw a vague mention on page 11.
rakesh sharma's user avatar
0 votes
1 answer
241 views

What SALT value will be used in HKDF_EXTRACT in TLS1.3?

What SALT value will be used in HKDF_EXTRACT while generating the Handshake Secret (when there will not be any PSK)?
rakesh sharma's user avatar
2 votes
3 answers
500 views

Are XOFs and KDFs more usable than DRBGs?

CSPRNGs have 2 design requirements: output unpredictability, back-tracing resistance. In addition to which, NIST SP 800-90Ar1 added other features such as a) instance customization/personalization,...
DannyNiu's user avatar
  • 9,422
1 vote
0 answers
248 views

Strongswan KDF Test

How can a KDF implementation for IKEv2 application, specifically in strongswan implementation case can be verified for conformance with NIST SP800-135, please? SP800-135 KDF recommendation further ...
neutrino's user avatar
2 votes
1 answer
288 views

How do i approach file encryption using encrypt-then-mac? [duplicate]

I'm programming a cryptographic application that encrypts files, locked with the password the user supplies. It's not intended to be used in production. It's a project for me to learn more about ...
Mick's user avatar
  • 23
12 votes
0 answers
2k views

Why does the Signal protocol use AES/CBC instead of AES/GCM?

AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information on its advantages against CBC ...
OughtToPrevail's user avatar
1 vote
1 answer
93 views

Does encrypting a result of AES block cipher provide more security?

I would like to know if encrypting a result of AES256 block cipher provides more security. Concretely, I am developing a system in which a client sends to a server a ciphertext encrypted with AES256. ...
mc9's user avatar
  • 177
3 votes
2 answers
2k views

How to generate a good symmetric secret key

I would like to generate a good secret key, that later will be used to encrypt data symmetrically. I am not sure how to generate a good secret key. I use Linux, I am not sure which sources of ...
uduck's user avatar
  • 75
6 votes
1 answer
2k views

Why derive keys from a master key instead of generating random keys?

I noticed AWS KMS generates encryption keys based off of a master key, using a key derivation function (HKDF). What's the practical advantage of deriving keys based on a master key? Isn't it simpler ...
Shruggie's user avatar
  • 237
4 votes
1 answer
494 views

Using a KDF (PBKDF2) properly

I am new to crypto. I have a password for my user, e.g. &&38:while:HAVE:havana:60&& I want to encrypt several documents with 10 pages each with AES....
Obiwahn's user avatar
  • 155
1 vote
2 answers
79 views

How secure is a book derived key and what can be done to strenghten it? [duplicate]

If you have a manual encryption system where the keying is done by extracting a key from a book, a major weakness is that an adversary can search trough all existing books to find a perfect Match and ...
user65597's user avatar
  • 107
1 vote
0 answers
1k views

Which 'info' and 'salt' parameters to use in HKDF for TLS 1.3?

all the following discussion is for HKDF in TLS1.3: Regarding the 'salt' parameter in - HKDF-Extract(salt, IKM) as written in RFC 5869: HKDF without having to protect the secrecy of the salt. In a ...
Martin's user avatar
  • 165
3 votes
1 answer
1k views

Is SHA-256 OK to use for key derivation for a key that is never persisted?

The scenario: On the one side a user enters a pass phrase to encrypt a stream of data (AES-GCM) and a symmetric encryption key is derived from the pass phrase using plain SHA-256 (so not a slow ...
J.R.'s user avatar
  • 31
2 votes
1 answer
482 views

Generating a key pair using a signature generated by an existing key

I’ve built an app in which each user has a private/public key pair and I want to generate a second one for them, however I cannot store the second private key anywhere. What would be the drawbacks ...
Michael Lorig's user avatar
1 vote
0 answers
141 views

Reason for including the public key of the key agreement in the KDF

I found the following text when looking up KDFs: In comparison, the so-called DHAES mode in IEEE 1363a mandates to use the binary representation of the sender’s public key as an input parameter. ...
Maarten Bodewes's user avatar
  • 93.2k
7 votes
3 answers
3k views

Formal description of KDF1 and KDF2

I've seen many descriptions of KDF1 and KDF2 by now, but most documents simply point to specifications that are behind a pay wall. These standards are not specific to the KDF's; they just use these ...
Maarten Bodewes's user avatar
  • 93.2k
1 vote
1 answer
81 views

Restricting output of key derivation function

Are there any suitable key derivation functions that allow the output to have certain constraints applied to them?` I know you can choose a length in some functions (HKDF for example), but what about ...
KSA's user avatar
  • 11
2 votes
1 answer
228 views

HKDF on output key material of previous HKDF

I understand the typical way to use HKDF is to make one call to HKDF to obtain multiple keys. Is it safe to use HKDF the following way to generate different keys ? If not, why? key0 = HKDF-extract-...
Raghu's user avatar
  • 255
3 votes
1 answer
2k views

What is meant by domain separation in the context of KDF?

This is a quote from my cryptography notes: If $h$ is a random function oracle of output length $n$ then also the two KDF constructions: $K(x) = h([0] \| x) \ldots \| h([L] \| x)$ $K(x) = h(x \| [0] )...
user1868607's user avatar
  • 1,243

1
3 4
5
6 7
13