Hot answers tagged

16 votes
Accepted

PBKDF vs HKDF for pretty long key

You're right: there is no need for key stretching if your key already has enough entropy to resist brute force attacks without it. A 128-bit keyspace should be plenty for that. AFAIK, there is no ...
16 votes
Accepted

Multiple AES Key Derivation from a master key

Multiple Key Generation from a Master key HMAC-based Key Derivation Function (HKDF) rfc5869 is what you are looking for. HMAC security proof uses the fact that the compression function of the ...
  • 45.5k
10 votes

How long to wait to feed hashing using SHA 256?

You should aggregate bits until you have enough seed bits to start your DRBG using an initial seed. Your seed should contain at least 128 bits of entropy (the amount of uncertainty to an attacker). ...
  • 88.5k
10 votes
Accepted

Choosing between simple Hash and HKDF to derive the second key used for MAC

The HKDF paper answers this question at length. Section 8 in particular seems to be the most relevant. But perhaps you may find that the explanations are very technical. To help you out a little ...
9 votes
Accepted

Faster alternative to HKDF

If you are using the full HKDF each time, you could possibly save time by only using the Extract portion once and Expand once per derived key. That could even halve the total time taken, if you had a ...
  • 31.7k
8 votes
Accepted

Why does HKDF use HMAC(salt, key) instead of HMAC(key, salt)?

To me it seems like HMAC(salt, IKM) would be weaker against a brute force search of IKMs, as the digest of the ...
  • 31.7k
8 votes

Do you really need a KDF when you have a PRF?

Do you really need a KDF when you have a PRF? Maybe. The security contract of a PRF requires that the key be a uniform random bit string. If you have a DH secret or a diceware phrase, then what you ...
7 votes
Accepted

Some Questions about the Veracrypt hash functions

These hash functions are also used for the key derivation function. Both are roughly equally secure for a KDF in the sense of collision resistance etc., but SHA512 offers a bit more security as ...
  • 933
6 votes

Which risks are associated with deriving multiple keys from the same DH secret Z?

What you propose—using the intermediate derivation key $K_{\mathit{DK}}$ from a single input $Z$ to derive many output keys with distinct info strings—is perfectly fine. The excerpt you quoted is ...
6 votes
Accepted

Negating the risk of a random 64-bit nonce

Without looking at the code I would say your construction is pretty much the same as XChaCha20: From https://download.libsodium.org/doc/advanced/xchacha20.html Internally, XChaCha20 works like a ...
  • 4,853
5 votes
Accepted

How long to wait to feed hashing using SHA 256?

There are three classes of random number generators (my own informal classes), dependant on the relative entropies that flow in and out:- Class 1. Hout < Hin, which is a true random number ...
  • 14.4k
5 votes
Accepted

The number of keys generated in TLS 1.2?

1) Does that means the kdf generates "actually" 6 keys, but in fact they are 4 keys? The KDF generates 6 values; of the 6, 4 of them can be considered "keys" (in the sense that they'll be used to key ...
  • 138k
5 votes
Accepted

KDF-based password manager

What you describe will work once, and it will be fine to use one salt, which need not even be secret as long as it's different from everyone else's salt. Just derive each service password from the ...
5 votes
Accepted

Can someone clarify two things about the HKDF by Krawczyk?

For example, there are no current attacks to HMAC-MD5, although MD5 is broken for several years. Hash functions have very strong requirements (e.g., collision resistance, preimage resistance, etc.), ...
  • 4,862
5 votes
Accepted

Difference between RFC-5869 (HKDF) and SP800-108 (Nist's HMAC-based KDF spec)?

RFC-5869 is about the "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)", while NIST SP-800-108 gives "Recommendation for Key Derivation Using Pseudorandom Functions". The main difference ...
  • 181
5 votes

What key is used to encrypt the certificate and certificate verify message in TLS1.3?

Due to the design of TLS 1.3 and different to earlier TLS versions the normal (EC)DHE key exchange is already finished once the server sends the certificate. They key ...
4 votes

Computing IV for CBC from PBKDF2 + HKDF

If I'm reading your specs correctly, you do this: $IV||VAL||K_E||K_A=KDF(PBKDF(PW,Salt,Iterations))$. (Order doesn't matter here) As far as I know this is common practice and shouldn't pose any ...
  • 45.2k
4 votes

SHA512 vs HKDF key expansion

I'm not aware of any attacks on SHA-512 this way. I would create a small function to validate that the input size to SHA-512 is indeed identical to the seed size though, just in case. Even without ...
  • 88.5k
4 votes
Accepted

What is the difference between KDFs for key derivation vs password stretching?

Deriving multiple keys from a strong source key material (which is what HKDF is for) is not key stretching. The important bit from from the Wikipedia excerpt is this one: 2./ To "expand" the ...
  • 387
4 votes

Security of HKDF when part of output is exposed

In a secure KDF, the output is indistinguishable from random. In particular, all the output bits are independent, so revealing some of the output doesn't give any indication about the other bits. ...
4 votes
Accepted

KDF vs Stream Cipher

It seems like a stream cipher will always be one-way, whereas a KDF might not be (see AES or DES key schedules for example). A KDF has nothing to do with DES or AES key schedules. Key schedules are ...
  • 88.5k
4 votes

Is HMAC a suitable substitute for HKDF?

HKDF is itself built from HMAC, so your question strikes me as a false dilemma. If you have HMAC, HKDF Is just a handful of HMAC calls; you could just implement your own. Yes, I know that "don'...
4 votes

HKDF: ikm, salt and info values

The salt is not required to make HKDF secure. Using a static salt doesn't make too much sense - you should be perfectly fine with using an empty salt. Either you can use an empty salt, or a new random ...
  • 88.5k
4 votes

Do you really need a KDF when you have a PRF?

Yet, I am not sure there are modern symmetric algorithms that require the secret to be uniformly distributed. Sure their security might be defined with a uniform key, [...] While people normally say ...
4 votes
Accepted

Static salt for PBKDF2, but unique salt for HKDF?

Yes, the salt in the HKDF can provide for key separation between the encrypt-then-mac applications. If that's needed depends on the system, maybe using an IV/nonce is enough, it depends on how many ...
  • 88.5k
4 votes

How many different keys can be derived with HKDF before two outputs are identical?

I've seen this a few times, so I want to point out something that is a general misconception. People often think that for key derivation, it's really important that I don't get repetition, since that ...
3 votes
Accepted

HMAC vs PKDBF2 as the first step towards HKDF

I don't think you get those "examples": they implement HKDF. The full name of HKDF is HMAC-based Extract-and-Expand Key Derivation Function. They do not use PBKDF2 because they don't ...
  • 88.5k
3 votes
Accepted

Properly securing a private key for remote storage

You should store a salt for HKDF-Hash alongside the encrypted message. That way, the adversary can't attack many passwords simultaneously. You should use your application's name, and the purpose of ...
3 votes

Maximum output of HKDF

The former. Maximum output must be <= 255*HashLen. So for SHA256 which has a digest of 32 bytes, max HKDF output would be <= 8160 bytes. For SHA512 which has a digest of 64 bytes, max output ...
  • 3,895
3 votes
Accepted

Can I use HKDF to improve security of HMAC used with weak hash function?

First of all: accelerating PBKDF by using a faster hash doesn't make sense; an attacker is likely to receive the same speedup. On 64 bit machines SHA-512 or one of the 384, 256 or 224 derivatives is ...
  • 88.5k

Only top scored, non community-wiki answers of a minimum length are eligible