Re: [Cfrg] On using ROs for analyzing randomness extraction functions

There are both quantitative problems and qualitative problems with this
type of universal hashing. The most obvious quantitative problem is that
if you start with (e.g.) a 256-bit elliptic-curve g^xy, and hash it to a
(e.g.) a 256-bit key, then the leftover-hash lemma says _nothing_ about
the resulting distribution. The most obvious qualitative problem is that
real-world protocols reuse Diffie-Hellman keys with multiple parties,
forcing the key-derivation function to eliminate related keys, which
universal hashing fails to do.

---D. J. Bernstein, Professor, Mathematics, Statistics,
and Computer Science, University of Illinois at Chicago

_______________________________________________
Cfrg mailing list
Cfrg@ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg