Skip to main content
16 votes
Accepted

Multiple AES Key Derivation from a master key

Multiple Key Generation from a Master key HMAC-based Key Derivation Function (HKDF) rfc5869 is what you are looking for. HMAC security proof uses the fact that the compression function of the ...
kelalaka's user avatar
  • 48.5k
10 votes
Accepted

Choosing between simple Hash and HKDF to derive the second key used for MAC

The HKDF paper answers this question at length. Section 8 in particular seems to be the most relevant. But perhaps you may find that the explanations are very technical. To help you out a little ...
Luis Casillas's user avatar
10 votes

How long to wait to feed hashing using SHA 256?

You should aggregate bits until you have enough seed bits to start your DRBG using an initial seed. Your seed should contain at least 128 bits of entropy (the amount of uncertainty to an attacker). ...
Maarten Bodewes's user avatar
  • 92.7k
9 votes

Do you really need a KDF when you have a PRF?

Do you really need a KDF when you have a PRF? Maybe. The security contract of a PRF requires that the key be a uniform random bit string. If you have a DH secret or a diceware phrase, then what you ...
Squeamish Ossifrage's user avatar
7 votes
Accepted

Some Questions about the Veracrypt hash functions

These hash functions are also used for the key derivation function. Both are roughly equally secure for a KDF in the sense of collision resistance etc., but SHA512 offers a bit more security as ...
BeloumiX's user avatar
  • 995
6 votes

Which risks are associated with deriving multiple keys from the same DH secret Z?

What you propose—using the intermediate derivation key $K_{\mathit{DK}}$ from a single input $Z$ to derive many output keys with distinct info strings—is perfectly fine. The excerpt you quoted is ...
Squeamish Ossifrage's user avatar
6 votes
Accepted

Negating the risk of a random 64-bit nonce

Without looking at the code I would say your construction is pretty much the same as XChaCha20: From https://download.libsodium.org/doc/advanced/xchacha20.html Internally, XChaCha20 works like a ...
Elias's user avatar
  • 4,913
6 votes
Accepted

Is the output of HKDF uniformly distributed, if my input is not?

All the answers can be found in the original paper: "Cryptographic Extraction and Key Derivation: The HKDF Scheme" which is generally available. Which properties are fullfilled, when IKM ...
Maarten Bodewes's user avatar
  • 92.7k
5 votes
Accepted

How long to wait to feed hashing using SHA 256?

There are three classes of random number generators (my own informal classes), dependant on the relative entropies that flow in and out:- Class 1. Hout < Hin, which is a true random number ...
Paul Uszak's user avatar
  • 15.4k
5 votes
Accepted

The number of keys generated in TLS 1.2?

1) Does that means the kdf generates "actually" 6 keys, but in fact they are 4 keys? The KDF generates 6 values; of the 6, 4 of them can be considered "keys" (in the sense that they'll be used to key ...
poncho's user avatar
  • 147k
5 votes
Accepted

KDF-based password manager

What you describe will work once, and it will be fine to use one salt, which need not even be secret as long as it's different from everyone else's salt. Just derive each service password from the ...
Squeamish Ossifrage's user avatar
5 votes
Accepted

Can someone clarify two things about the HKDF by Krawczyk?

For example, there are no current attacks to HMAC-MD5, although MD5 is broken for several years. Hash functions have very strong requirements (e.g., collision resistance, preimage resistance, etc.), ...
cygnusv's user avatar
  • 4,962
5 votes
Accepted

Difference between RFC-5869 (HKDF) and SP800-108 (Nist's HMAC-based KDF spec)?

RFC-5869 is about the "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)", while NIST SP-800-108 gives "Recommendation for Key Derivation Using Pseudorandom Functions". The main difference ...
rob's user avatar
  • 181
5 votes

What key is used to encrypt the certificate and certificate verify message in TLS1.3?

Due to the design of TLS 1.3 and different to earlier TLS versions the normal (EC)DHE key exchange is already finished once the server sends the certificate. They key ...
Steffen Ullrich's user avatar
4 votes

Is HMAC a suitable substitute for HKDF?

HKDF is itself built from HMAC, so your question strikes me as a false dilemma. If you have HMAC, HKDF Is just a handful of HMAC calls; you could just implement your own. Yes, I know that "don'...
Luis Casillas's user avatar
4 votes
Accepted

What is the difference between KDFs for key derivation vs password stretching?

Deriving multiple keys from a strong source key material (which is what HKDF is for) is not key stretching. The important bit from from the Wikipedia excerpt is this one: 2./ To "expand" the ...
Xander's user avatar
  • 387
4 votes

Security of HKDF when part of output is exposed

In a secure KDF, the output is indistinguishable from random. In particular, all the output bits are independent, so revealing some of the output doesn't give any indication about the other bits. ...
Gilles 'SO- stop being evil''s user avatar
4 votes
Accepted

KDF vs Stream Cipher

It seems like a stream cipher will always be one-way, whereas a KDF might not be (see AES or DES key schedules for example). A KDF has nothing to do with DES or AES key schedules. Key schedules are ...
Maarten Bodewes's user avatar
  • 92.7k
4 votes

HKDF: ikm, salt and info values

The salt is not required to make HKDF secure. Using a static salt doesn't make too much sense - you should be perfectly fine with using an empty salt. Either you can use an empty salt, or a new random ...
Maarten Bodewes's user avatar
  • 92.7k
4 votes

Do you really need a KDF when you have a PRF?

Yet, I am not sure there are modern symmetric algorithms that require the secret to be uniformly distributed. Sure their security might be defined with a uniform key, [...] While people normally say ...
Luis Casillas's user avatar
4 votes
Accepted

Static salt for PBKDF2, but unique salt for HKDF?

Yes, the salt in the HKDF can provide for key separation between the encrypt-then-mac applications. If that's needed depends on the system, maybe using an IV/nonce is enough, it depends on how many ...
Maarten Bodewes's user avatar
  • 92.7k
4 votes

How many different keys can be derived with HKDF before two outputs are identical?

I've seen this a few times, so I want to point out something that is a general misconception. People often think that for key derivation, it's really important that I don't get repetition, since that ...
Yehuda Lindell's user avatar
4 votes
Accepted

Applications in which you should/shouldn't use a salt with HKDF

The use of a salt serves two purposes: domain separation and randomness extraction. If you are sure that your IKM (input keying material) is only being used in one "domain", you do not need ...
knaccc's user avatar
  • 4,732
3 votes

Maximum output of HKDF

The former. Maximum output must be <= 255*HashLen. So for SHA256 which has a digest of 32 bytes, max HKDF output would be <= 8160 bytes. For SHA512 which has a digest of 64 bytes, max output ...
hunter's user avatar
  • 3,975
3 votes
Accepted

HMAC vs PKDBF2 as the first step towards HKDF

I don't think you get those "examples": they implement HKDF. The full name of HKDF is HMAC-based Extract-and-Expand Key Derivation Function. They do not use PBKDF2 because they don't ...
Maarten Bodewes's user avatar
  • 92.7k
3 votes
Accepted

Clarification needed in TLS 1.2 key derivation process

There are a few things off in your description. First, you use the term "hkdf". There is such a thing as HKDF, which is a key derivation function that internally uses HMAC; however, HKDF is ...
Thomas Pornin's user avatar
3 votes
Accepted

Doing RSA-KEM with RSA-OAEP

If what you have is a machine that computes RSAES-OAEP and not a machine that computes $x \mapsto x^e \bmod n$, you don't really have the tools to do RSA-KEM. You're better off doing what you were ...
Squeamish Ossifrage's user avatar
3 votes

Using HKDF to derive symmetric keys from a hybrid public-key encryption scheme

Fix an RSA modulus $n$. Here's a way you can send a message $m$ so that only someone who knows the secret factorization of $n$ can read it. Pick an integer $1 < x < n$ uniformly at random. ...
Squeamish Ossifrage's user avatar
3 votes
Accepted

Properly securing a private key for remote storage

You should store a salt for HKDF-Hash alongside the encrypted message. That way, the adversary can't attack many passwords simultaneously. You should use your application's name, and the purpose of ...
Squeamish Ossifrage's user avatar
3 votes
Accepted

HKDF on output key material of previous HKDF

It's not necessarily unsafe to create keys that way, but: the x-coordinates of the public key are already used for calculating Z, so I don't see why inclusion in the KDF makes any difference; without ...
Maarten Bodewes's user avatar
  • 92.7k

Only top scored, non community-wiki answers of a minimum length are eligible