[Cfrg] Fwd: Hash-Based Key Derivation

[David Wagner <[e-mail]>]

Dan Brown writes:
>Aside, if H fails to be collision-resistant (for its length), isn't there 
>an argument that it isn't pseudorandom?  I suppose that depends very much 
>on the definition of PRF, of course.

First, there is only one definition of PRF: the standard one.

Second, the first question in some sense has a type error: a PRF takes
two inputs (a key and a 'message'), while a hash takes one input (a
'message').

But supposing that we view a hash H as a PRF through the construction
F(K,X) = H(K||X), then the answer is "No".  It is possible for a
function to be pseudorandom but not collision-resistant.  For example,
take this function:
  Evil(K,X):
  1. If K = 0^128, output 0^128.
  2. Otherwise, output AES(K,X).
This is pseudorandom but not collision-resistant, since
  Evil(0^128,X) = Evil(0^128,X') for any X!=X'.

_______________________________________________
Cfrg mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/cfrg