[Cfrg] Fwd: Hash-Based Key Derivation

Simon Blake-Wilson writes:
>Thanks David ... interesting stuff. You clearly have a clear idea of what
>you think a KDF does in terms of security, but I guess I'd still like to
>see a convincing formal defintion.

For me, a KDF is a function that takes a secret input S and some auxiliary
input X.  The security requirement is that KDF(S,X) should act as a
pseudorandom function: in other words, an attacker should not be able
to distinguish KDF(S,.) from R(.), where R is a uniformly random function.

Achieving this security requirement will require some assumptions on the
distribution on S.  Thus, we can talk about a particular scheme being
a good KDF for some particular distribution on S (e.g., the uniform
distribution), or being a good KDF for some class of distributions
(e.g., distributions with high min-entropy).  Standard PRFs suffice if
the secret S is known to be uniformly distributed (or pseudorandom).
In the random oracle model, pre-hashing followed by a PRF suffices if
the secret S is known to have high min-entropy and is generated by an
efficient procedure that is independent of the random oracle.

>Also if making random oracle model assumptions is OK, then the definition
>in the I-D is also likely to be good, isn't it? For example, won't H(S|X)
>also be a good KDF if H is assumed to be a random oracle?

Yes, both H(S||X) and F(H(S),X) are good KDFs in the random oracle model.
However, I prefer the latter, because it minimizes the use of the
random oracle assumption.  The former assumes that the hash function
remains secure even if the adversary can specify many X-values and learn
H(S||X) for each such X (with the same S throughout).  This is a strong
assumption, which our hash functions weren't necessarily designed for.
The latter scheme makes a weaker assumption: that the hash function works
when the attacker does not have this extra ability to specify X-inputs.
Therefore, F(H(S),X) reduces our reliance on the hash function.  This is
admittedly a subtle point.  Still, as I remember Mihir Bellare and Phil
Rogaway putting it once, the weaker the assumptions you start from,
the less likely the scheme is to disappoint.

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg