IETF Logo Mail Archive

[Cfrg] Fwd: Hash-Based Key Derivation

David Wagner <daw@cs.berkeley.edu> Tue, 25 October 2005 21:39 UTC

Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EUWW6-0007dh-9V; Tue, 25 Oct 2005 17:39:34 -0400
Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EUWW4-0007dT-Mp for cfrg@megatron.ietf.org; Tue, 25 Oct 2005 17:39:32 -0400
Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA16397 for <cfrg@ietf.org>; Tue, 25 Oct 2005 17:39:17 -0400 (EDT)
Received: from taverner.cs.berkeley.edu ([128.32.168.222]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1EUWj5-00031b-Ru for cfrg@ietf.org; Tue, 25 Oct 2005 17:53:01 -0400
Received: from taverner.CS.Berkeley.EDU (localhost.localdomain [127.0.0.1]) by taverner.CS.Berkeley.EDU (8.13.1/8.13.1) with ESMTP id j9PLdK6n021466 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 25 Oct 2005 14:39:20 -0700
Received: (from daw@localhost) by taverner.CS.Berkeley.EDU (8.13.1/8.13.1/Submit) id j9PLdKrj021462; Tue, 25 Oct 2005 14:39:20 -0700
From: David Wagner <daw@cs.berkeley.edu>
Message-Id: <200510252139.j9PLdKrj021462@taverner.CS.Berkeley.EDU>
Subject: [Cfrg] Fwd: Hash-Based Key Derivation
To: cfrg@ietf.org
Date: Tue, 25 Oct 2005 14:39:20 -0700
Secret-Bounce-Tag: 9a029cbee41caf2ca77a77efa3c13981
X-Mailer: ELM [version 2.5 PL6]
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 7d33c50f3756db14428398e2bdedd581
Content-Transfer-Encoding: 7bit
X-BeenThere: cfrg@ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: David Wagner <daw-usenet@taverner.CS.Berkeley.EDU>
List-Id: Crypto Forum Research Group <cfrg.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@ietf.org?subject=unsubscribe>
List-Post: <mailto:cfrg@ietf.org>
List-Help: <mailto:cfrg-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/cfrg>, <mailto:cfrg-request@ietf.org?subject=subscribe>
Sender: cfrg-bounces@ietf.org
Errors-To: cfrg-bounces@ietf.org

Simon Blake-Wilson writes:
>"the thing that turns an unpredictable value into a pseudorandom value" [..]
>The only thing which does it that has come up so far is a random oracle ...
>
>But a random oracle assumption seems like a pretty unsatisfactory solution
>to the problem to me ... It feels like taking a heavy weight tool to solve
>a light weight problem.

The random oracle model is a heavyweight tool -- but this is heavyweight
problem.  I'm not sure why you feel it is a lightweight problem.  Indeed,
there is NO known solution to this problem in the standard model.  If you
start with a secret value that is not known to be uniformly distributed,
but is only known to have high min-entropy, then the only (provably secure)
way I know of to get a good key out of it is to use a random oracle.

(For others who are reading, by 'this problem' I mean the problem of
taking a secret input that is known only to have high min-entropy and
turning it into a pseudorandom value that can be used as a key.  A random
oracle solves this problem, as long as we assume that the distribution
that that the secret comes from is efficiently samplable and has high
min-entropy and its distribution is independent of the random oracle.)

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg

v2.23.0 | Report a Bug | By Email