Questions tagged [key-derivation]

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function. Keyed cryptographic hash functions are popular examples of pseudo-random functions used for key derivation.

Filter by
Sorted by
Tagged with
0
votes
1answer
157 views

Does mixing two derived keys make a stronger key? And if so, how would I mix?

I have to generated a secure key from some meta data and a password, and I'm free to choose among a dozen of key derivation functions (KDFs). The problem is, I'm not too happy with either one. Some ...
0
votes
1answer
74 views

Are there any downsides to key stretching an already high quality entropic key?

For example, if we grab 50 bytes from a high quality source and run them through a key stretching function like Argon2 and have it generate a 32 byte secret for AES. Is there any downside to this? Do ...
1
vote
2answers
116 views

P2P encryption - Do I need a different session key each time?

I am using AES128-CBC+HMAC for all encryption. Currently I am using the same encryption and authentication/MAC key (Both derived from a master key with HKDF). Assuming that forward secrecy is not a ...
3
votes
3answers
391 views

Use of PBKDF2 when no access to HKDF?

I would like to use a unique encryption key and authKey for each payload that I encrypt and authenticate via AES256 CBC with HMAC-SHA256. I'm considering the following: ...
4
votes
1answer
145 views

Is it secure to cascade KDFs

I would like to know if the following process to generate keys for a set of devices is secure. Let’s say I have a 128-bit master key MK with high entropy. I use a KDF to generate a 128-bit device key ...
3
votes
1answer
78 views

Deriving user keys from ID

The "normal idea" is to generate a key per user, send them to the users (securely, of course), and store them in a database. But what if I use a keyed hash (like Blake2b) with a server key and then ...
6
votes
1answer
512 views

Derivation of many (Key, IV) pairs from random 128 nonces and one secret 512 master key

The ext4 encryption system encrypt files with aes-256-xts. Each file uses two unique keys which are derived from a 512 bit master key and a per-file 128 bit nonce randomly generated when the file is ...
6
votes
2answers
214 views

FIPS 202/SHAKE: insecure 3DES key derivation example

I'm trying to understand the following passage from FIPS 202 (the SHA-3 standard), discussing the SHAKE functions' correlated outputs for different output lengths and the risks they induce in some ...
4
votes
1answer
371 views

KDF vs Stream Cipher

I was wondering why someone would go and use HKDF (or any KDF) when they can use a stream cipher instead. It seems like a stream cipher will always be one-way, whereas a KDF might not be (see AES or ...
1
vote
1answer
477 views

Is this symmetric key MAC-then-encrypt auth token methodology secure?

NOTE: This question originally conflated a "digital signature" and a "MAC", which I've since learned are not the same thing. Any references (in the answer or any comments) to a "signature" should be ...
2
votes
2answers
672 views

How to properly AES encrypt a string, deriving the key from the same string?

Let's say someone has a list of names, e.g.: 'Batman' 'Batman' 'Super Man' I am auditing this list, but I'm not allowed full access to all names. So they must be ...
10
votes
1answer
555 views

Can someone clarify two things about the HKDF by Krawczyk?

I got a question about the HKDF Scheme by Hugo Krawczyk. On the following link you can find a small explanation of the HKDF-Scheme and some short informations. The HKDF specification itself has been ...
1
vote
1answer
67 views

Special equivalent key in symmetric encryption

Let $k$ and $k'$ be two keys of symmetric encryption such that for some $m$ we have $ Enc_k(m)=Enc_{k'}(m)$. Is it possible to exist a plain text $m'$ such that $Enc_k(m') \neq Enc_{k'}(m')$. In fact,...
2
votes
1answer
345 views

How to securely combine multiple sources of entropy?

Suppose that I have $n$ secure 32-bit keys that were generated separately using methods that are known to be secure. For example, one of them might have been generated by using a proven CSPRNG. ...
5
votes
3answers
1k views

Derive a key from a password and another key?

I would like to encrypt some data using a password. I want to use a function like PBKDF2 to turn my password into a key. However, I would like to also require a keyfile, for added security. My data ...
-2
votes
2answers
308 views

Very simple, very memory-hard (?) password-based key derivation

I know the problem of memory-hard password-based key derivation functions is better left to the likes of scrypt, argon2, etc... But validated implementations of those algorithims are not always ...
3
votes
1answer
175 views

Cryptsetup | Given Enough Passphrase Entropy, Is It Necessary To Use a High Iteration Count?

Let's assume that, for creating a LUKS volume, I generate a random, 40 character passphrase that includes numbers, symbols, and upper and lower case letters, using the ...
13
votes
1answer
7k views

Is there any benefit from using SHA-512 over SHA-256 when AES just truncates it anyway?

I am still not very clear on how AES-256-CBC can use SHA-512 bit keys, but I assume that it just truncates the 512bit hash down to 256bit. In software like GnuPG and OpenPGP, is there any real benefit ...
11
votes
3answers
1k views

Is deriving the IV from the password secure?

I came across an encryption scheme to encrypt files with AES-256. You can see the initialization of the decryption routine below: ...
6
votes
2answers
1k views

Difference between RFC-5869 (HKDF) and SP800-108 (Nist's HMAC-based KDF spec)?

I'm trying to find the difference between the two aforementioned algorithms. It seems that one is either a subset of the other. Could someone explain the similarities/differences?
1
vote
1answer
179 views

What are the typical input lengths for KDFs?

I am looking for typical input lengths for key derivation functions like the HKDF. I know the parameters of HKDF, but can not find any information about typical input sizes to HKDF or any of the other ...
3
votes
1answer
708 views

What is the difference between KDFs for key derivation vs password stretching?

This was mentioned in the comments to another question: To clarify: This is about key-stretching KDFs. Not the kind for diversifying keys (eg. HKDF) and There are two kinds of KDF, the slow, ...
0
votes
1answer
62 views

Key Prefix KDF with Counter

I don't want to discuss the security problem with MD-based hashfunctions when using them as KDF. Since the existence of SHA3 or Skein hashfunction it is possible to use them as key prefix KDF. What I ...
3
votes
1answer
59 views

Desirable Property of Block Sub-Keys

What is the more desirable for a block cipher's sub-keys ? Given two blocks ciphers, letting all other properties be equal (they have the same strength), the only difference between them is that: ...
2
votes
1answer
99 views

Is there an algorithm to derive a 1-of-N shared secret from a set of N private keys?

This is different from Shamir's Secret Sharing in that we are starting with the keys and deriving a shared secret, rather than the other way around. Let me be more precise: We are given keys $k_1, \...
7
votes
2answers
15k views

Key derivation functions (KDF): What are? Main purposes? How can they be used?

What are KDFs? What are their main purposes? How they can be used, in other words, what's their drill in a cryptography scheme?
13
votes
3answers
750 views

Is it better to maximize memory usage or number of passes with Argon2i 1.3?

I wrote a small application that uses Argon2i for deriving symmetric keys for encryption of local files and secret Curve25519 keys. Argon2i v1.3 is susceptible to TMTO attacks if the number of passes ...
1
vote
1answer
232 views

PKCS12 key derivation

In older versions of PKCS#12 there was a key derivation function that, near as I can tell, isn't used anywhere outside of that standard: https://tools.ietf.org/html/rfc7292#appendix-B That discusses ...
2
votes
0answers
2k views

What is the use of key iterations?

I read about PBKDF2 on Wikipedia and seen few apps. having option to manually enter number of iterations. I am still not clear on this. (1) With what I understood, key iterations can be used only ...
1
vote
0answers
45 views

Using multiple iterations of Argon2i

Consider Argon2i used as a key derivation function (implemented by the libsodium crypto library) to derive an encryption key from a password. Additionally, when entering the password a second time, ...
13
votes
3answers
6k views

How many KDF rounds for an SSH key?

What is the best practice on choosing how many key derivation function (KDF) rounds/iterations when generating an SSH key pair with ssh-keygen? Am I correct in saying that it is unnecessary if the ...
2
votes
1answer
91 views

Using only pseudorandom function to drive many deterministic keys

My question is related to: Can Pseudorandom values be used as secure keys? But here I'm only using pseudorandom function. Assume we have a pseudorandom function, $PRF$. We have a truly random ...
6
votes
1answer
406 views

Ephemeral Encryption Keys

My understanding is, ignoring implementation details, iOS disk encryption works like this: On boot (and/or every time you unlock your phone) an ephemeral session key is created that can decrypt ...
1
vote
3answers
157 views

Function to derive an integer from a given password

I need to get an int, derived by a given password, to feed it to a deterministic PRNG as a seed. The derived int should not give away any clues about the password. How can I achieve this without ...
2
votes
1answer
635 views

AES vs AES-CMAC for session key derivation

Assume two parties have exchanged a secret 128-bit Master Key, MK. When the two parties want to communicate, one of them generates a random 128-bit value, R, which is then sent in plaintext to the ...
2
votes
1answer
2k views

Generating passwords using Password-Based Key Derivation Function

I was thinking of using different and independent password for different websites, but not storing them in some password manager so I don't need to backup the passwords. I thought I could use some ...
1
vote
2answers
737 views

security of using digital signature as key derivation material

I want all keys in my iOS application to rely on the Secure Enclave for security as the iOS keychain becomes insecure on jailbroken devices. Currently, the Secure Enclave currently only supports ...
8
votes
2answers
563 views

Are there key-derivation functions that are safe to use in parallel on the same secret?

I'm considering using a key-derivation scheme for generating multiple keys from the same user secret. It is important that given all but one of these derived keys, it is not feasible to calculate the ...
12
votes
2answers
1k views

Can any MAC be used as a KDF?

First, let me clarify what I mean with a Key Derivation Function (KDF). I'm interested in KDFs that take an $n$-bit symmetric master key and some diversification data of arbitrary length as input and ...
1
vote
0answers
60 views

Password manager that uses a mix of long and short key derivation functions

I was reading "A Convenient Method for Securely Managing Passwords, Halderman et al., 2005". In short, the authors say to do the following: ...
6
votes
2answers
327 views

Are there any high level memory-hard PBKDF constructions?

The PBKDF2 construction from PKCS #5 v2 has the convenient feature that it can be implemented using only standard interchangeable cryptographic primitives. Specifically, it only requires the ...
2
votes
1answer
48 views

Older key as PGP subkey?

Currently I have a 2048-bit PGP key. Suppose I create a new 4096-bit key. Can I add that old key as a subkey of this new one?
8
votes
2answers
7k views

What are KDF parameters in OpenSSL command-line utility for `enc`?

I refer to https://www.openssl.org/docs/manmaster/apps/enc.html and see that the only parameter for key derivation which I can set explicitly (not considering the obvious ...
3
votes
1answer
336 views

Key derivation with Curve25519 for data encryption

I'm new when it comes to cryptography so this question might be a little bit stupid: Can I derive a key with Curve25519 from a (let's say) root key and encrypt the file with a secret key algorithm? ...
2
votes
1answer
129 views

Master keys' strengh

If I am going to use a master key to generate a session key, why the master key must be "stronger" than the session key? Like should not be distributing 128-bit AES keys derived from a 56-bit DES key....
1
vote
1answer
73 views

How do two parties put together the AUTH data in the SKEME protocol?

SKEME is a Key Exchange protocol used in the Internet Key Exchange (IKE). It contains three phases: SHARE, EXCH, and ...
2
votes
1answer
798 views

AES GCM encryption, authentication and PBKDF2

I'm developing a kind of secret vault server application. The basic principle is similar to DPAPI where each secret will have its own unique random KEY/IV pair and and that KEY/IV pair will be ...
5
votes
2answers
877 views

Can CMAC be used as a 128bit Key Derivation Function?

I want to derive a key a number of times for a deterministic scenario, where I can get n keys from a single one. The logic looks something like this: ...
5
votes
0answers
84 views

Is correlation in vector distributions “dangerous”?

Consider the two vector distributions $\xi,\chi$ described below, each one outputting integer vectors of length $n$ with coefficients in $\{0,\dots,n\}$. Distribution $\xi$ samples each coefficient $...
2
votes
2answers
134 views

Key management and derivation - Allow changing of the passphrase

I'm working on a program, which allows encrypting files before storing it on a cloud service. Currently I'm trying to figure out how to derive and store the keys. First, I wanted to use a simple ...