# Tag Info

3

I dont understand the use of the info parameter, what does "to fold in identity information" mean? It essentially is context information; that is, protection so that the ciphertext can't be reused in a different context. Here is a simple example; suppose I encrypt a message to you, and fgrieu intercepts it. Now, what fgrieu could do is forward ...

3

Yes, the salt in the HKDF can provide for key separation between the encrypt-then-mac applications. If that's needed depends on the system, maybe using an IV/nonce is enough, it depends on how many messages you want to encrypt and the used encryption and MAC scheme basically. Some other remarks: we derive keys - not passwords - for ciphers and MAC ...

3

I've seen this a few times, so I want to point out something that is a general misconception. People often think that for key derivation, it's really important that I don't get repetition, since that is a break. However, this is actually very not true, and the opposite is true. I will explain. The "ideal situation" is to just choose keys, truly at ...

2

Or would it be better to use something like HKDF? Generally? Yes. Using HKDF is preferred, if only to communicate clearer what you're actually doing here. Is it acceptable to use PBKDF2 with just 1 iteration to do the simple key expansion that I need? Yes. To explain this, we first need to understand how PBKDF2 works. First, note that it compute $\ell$ ...

1

The present answer is made for the sake of answering an answerable question, and the cases where collisions actually matter: like, they are observed and we want to rule out it's by chance; or some authority specified that each smurf must have a unique key, and lack of a convincing argument for that separates the rubber stamp from the paperwork. See Yehuda ...

1

Very shortly, yes, this is the case. A KDF is secure if an adversary cannot make a distinction between the output of the KDF and random output (with a larger probability of ${1 \over 2} + \epsilon$). The attacker gets to know the salt and is able to choose the $Info$ parameter and output size (i.e. all the other input parameters) as well as any previous ...

Only top voted, non community-wiki answers of a minimum length are eligible