RE: [Cfrg] Fwd: Hash-Based Key Derivation

["Simon Blake-Wilson" <[e-mail]>]

Right ... A few years ago when I tried to sit down and right a good
definition of secure KDF, I pretty quickly convinced myself that a random
oracle and some length encoding produced one ;-).

Best regards. Simon

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On 
> Behalf Of Blumenthal, Uri
> Sent: Tuesday, October 25, 2005 3:21 PM
> To: [e-mail]
> Subject: RE: [Cfrg] Fwd: Hash-Based Key Derivation
> 
> 
> > Is there a proof somewhere that pre-hashing then MACing makes a good
> KDF?
> 
> AFAIK - such a proof does not exist (yet?). 
> 
> Regarding hash - some people claim, that based on their 
> experience, crypto-hash output is "random enough". I 
> personally find it somewhat "unscientific". :-)
> 
> > I'd be interested to see it.
> 
> Me too.
> 
> > -----Original Message-----
> > From: [e-mail] [mailto:[e-mail]] On
> > Behalf Of David Wagner
> > Sent: Tuesday, October 25, 2005 2:41 PM
> > To: [e-mail]
> > Subject: [Cfrg] Fwd: Hash-Based Key Derivation
> > 
> > 
> > Simon Blake-Wilson writes:
> > >Is it really true that you can build a KDF like this based
> > on standard
> > >assumptions about a MAC? [...] MACs are by design secure 
> only if the 
> > >key is pseudorandom, aren't they?
> > 
> > Yes, in general, you are right.  The fix is to pre-hash the
> > key. So you might use F(S,X) = SHA256-HMAC(SHA256(S), X), 
> > where S is the secret.
> > 
> > For HMAC, it might just happen to be the case that
> > pre-hashing is unnecessary -- I don't know, and I haven't 
> > tried to do the analysis.
> > 
> > _______________________________________________
> > Cfrg mailing list
> > [e-mail]
> > https://www1.ietf.org/mailman/listinfo/cfrg
> > 
> 
> _______________________________________________
> Cfrg mailing list
> [e-mail]
> https://www1.ietf.org/mailman/listinfo/cfrg
> 

_______________________________________________
Cfrg mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/cfrg