We’re rewarding the question askers & reputations are being recalculated! Read more.

Hot answers tagged

8

As far as I know (which, admittedly, might be limited; I do not claim to possess encyclopedic knowledge of attacks on KDFs), there are no known practical attacks against KDF1 or KDF2 (which are also mentioned on this page, following ISO-18033-2) when instantiated with a secure hash function. Regarding the relative security of these KDFs vs. HMAC-based KDFs ...


5

Background When defining protocol compliant with NIST SP 800-108, you just need to pick suitable options, which work well with your protocol. If there is a need to be compatible with a specific pre-existing protocol, you may want to take a look at NIST SP 800-135Rev1, which defines application specific key derivation functions. It is notable to recognize ...


3

If you have plenty entropy in your "seed" then just use a KBKDF such as HKDF. If you have somewhat less, use a PBKDF such as PBKDF2. Both HKDF and PBKDF2 can take a salt as input parameter and are already using a HMAC internally. There is no need to perform a HMAC beforehand. If you do, you would have to specify what data is used as key for the HMAC ...


2

By HKDF, I guess you mean HKDF-Expand, which takes as input a pseudorandom key, a label, and the output length. A public label is OK, but it is better unique rather than random due to HKDF-Expand's pseudorandom function security. I think using UUID only as the label is good enough.


1

Since as of now (2018) there seems to be no official test vectors, I generated some of may own. The whole list covering SHA1, SHA256, SHA512 and HMAC-SHA256/SHA512 can be found here: https://github.com/patrickfav/singlestep-kdf/wiki/NIST-SP-800-56C-Rev1:-Non-Official-Test-Vectors Here is a snippet: SHA-256 (z: afc4e154498d4770aa8365f6903dc83b, L: 16, ...


Only top voted, non community-wiki answers of a minimum length are eligible