[Cfrg] Fwd: Hash-Based Key Derivation

[David Wagner <[e-mail]>]

Daniel Brown writes:
>A KDF should be "one-way" [...]
>certain PRFs can fail to be 1-way.

I believe a KDF only needs to be one-way in the sense that given
KDF(K,X) you cannot recover K.  (It does not need to be one-way in
the usual sense: it doesn't matter if given Y=KDF(K,X) you can recover
some other K' s.t. KDF(K',X)=Y, so long as K' reveals nothing about K.)

Assuming that is what you meant, every PRF is one-way in this sense.
If you could recover the key K from F(K,X), then you could distinguish
the PRF from random (just choose some other X' and confirm that on
input K' your oracle responds with F(K,X')).

So this is not an issue: the PRF requirement already implies all the
one-wayness properties that you might want a KDF to have.

>If the PRF is 
>the identity and the secret input is uniform and unpredictable, then the 
>output is indistinguishable (from random), so it seems to be a PRF.

If you mean F(K,X)=K, that's not a PRF.  The attack: Choose X, X'
distinct.  Send X and X' to your oracle, receiving Y and Y'.  If Y=Y',
then your oracle is a F(K,.) oracle; otherwise, your oracle is a random
function.  So you've distinguished F(K,.) from random.

_______________________________________________
Cfrg mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/cfrg