KDF definition and goal [was: [Cfrg] Fwd: Hash-Based Key Derivation]

David McGrew writes:
>show a KDF design that's secure in the random  
>oracle model, but which is not secure in the reduction-based model.

KDF1(K,X):
1. If H(X)=SHA256(0), output K.
2. Otherwise, output H(K||X).

KDF2(K,X):
1. Try to parse X as the description of a circuit C.
2. If that succeeds, pick Z at random.  If H(Z)=C(Z), then output K.
3. Otherwise, output H(K||X).

KDF1 is secure in the random oracle model, but insecure when the
hash is instantiated by SHA256 (just choose X=0 to break it).

KDF2 is secure in the random oracle model, but insecure when the
hash is instantiated by any real hash function (just choose X to be
a description of the hash circuit to break it).

These are essentially the classic methods for separating the random
oracle model from the standard model.  As you can see, they both will
end up with a KDF construction that looks contrived and fishy.

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg