Re: KDF definition and goal [was: [Cfrg] Fwd: Hash-Based Key Derivation]

David Wagner writes:
> The Leftover Hash Lemma requires that
> the 2-universal hash be chosen randomly.  You have specified a scheme
> where we use a single hash function that has been fixed in advance --
> but then the Leftover Hash Lemma is not applicable.

The hash function has to be chosen randomly, and has to be independent
of all the other random choices in the protocol, but this doesn't mean
that the choice has to wait until the last possible moment! A single
random hash function can be standardized and reused for many keys. See,
e.g., Shoup's Computational Introduction to Number Theory and Algebra,
Theorem 6.22.

Regarding the number of secure bits obtained in this way: My point was
that there's an obvious, and quite severe, limit on the number. Perhaps
the limit is actually even smaller; I made no effort to check.

---D. J. Bernstein, Professor, Mathematics, Statistics,
and Computer Science, University of Illinois at Chicago

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg