RE: [Cfrg] Fwd: Hash-Based Key Derivation

On Tue, 25 Oct 2005, Blumenthal, Uri wrote:

>> Is there a proof somewhere that pre-hashing then MACing makes a good
> KDF?
>
> AFAIK - such a proof does not exist (yet?).
>
> Regarding hash - some people claim, that based on their experience,
> crypto-hash output is "random enough". I personally find it somewhat
> "unscientific". :-)
>
>> I'd be interested to see it.
>
> Me too.

Actually, such a proof doesn't exist; you need further assumptions beyond 
the standard.  Trivial example: take a secure MAC, and produce a varient 
by prepending the output with a zero bit:

    tMAC(key, text) = 0 + MAC(key, text)

tMAC is obviously a secure MAC if the underlying MAC is, however, it is 
obviously not a secure PRF.

Sigh...

>
>> -----Original Message-----
>> From: cfrg-bounces@ietf.org [mailto:cfrg-bounces@ietf.org] On
>> Behalf Of David Wagner
>> Sent: Tuesday, October 25, 2005 2:41 PM
>> To: cfrg@ietf.org
>> Subject: [Cfrg] Fwd: Hash-Based Key Derivation
>>
>>
>> Simon Blake-Wilson writes:
>>> Is it really true that you can build a KDF like this based
>> on standard
>>> assumptions about a MAC? [...] MACs are by design secure only if the
>>> key is pseudorandom, aren't they?
>>
>> Yes, in general, you are right.  The fix is to pre-hash the
>> key. So you might use F(S,X) = SHA256-HMAC(SHA256(S), X),
>> where S is the secret.
>>
>> For HMAC, it might just happen to be the case that
>> pre-hashing is unnecessary -- I don't know, and I haven't
>> tried to do the analysis.
>>
>> _______________________________________________
>> Cfrg mailing list
>> Cfrg@ietf.org
>> https://www1.ietf.org/mailman/listinfo/cfrg
>>
>
> _______________________________________________
> Cfrg mailing list
> Cfrg@ietf.org
> https://www1.ietf.org/mailman/listinfo/cfrg
>

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg