[Cfrg] KDF: Randomness extraction vs. key expansion

Ran Canetti writes:
>A remark on randomness extraction: Randomness extraction becomes
>significantly easier if the extracting function has some public random input
>that is independent from the secret value. In many situations such public
>randomness is readily available (eg, take the nonces used in the exchange).

Hey, that's a clever idea.  I hadn't heard that one before.

But does it really work?  Can we safely use the nonces "as-is"?
What's got me worried is that one of the nonces could have been chosen
by an attacker.  See my previous email for some example scenarios where
everything breaks if the adversary can choose the value of the public
randomness.

Perhaps you mean that we should hash the concatenation of the nonces?
In the random oracle model, that sounds like it should work, but then
we're back to the random oracle model again (where we can already solve
this problem without needing public random inputs).  And I don't see
how to combine nonces securely in the absence of the random oracle model.

Maybe we could have both parties commit to their nonce, then once
the commitments are revealed, have both parties open the commitments,
and use the xor of the nonces are our public randomness (taking care
to avoid reflection and malleability attacks).  But I doubt that many
existing protocols are already doing this, and it sounds like it might
be a somewhat annoying change to have to make to an existing protocol.

Is there any analysis of how to make some idea like this work, without
using the random oracle model?

(I'm finding this to be a fascinating discussion, by the way...)

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg