Subject: [Cfrg] Fwd: Hash-Based Key Derivation

From: David Wagner <[email-masked]>
Date: Tue, 25 Oct 2005 11:41:14 -0700 (PDT)

Simon Blake-Wilson writes:
>Is it really true that you can build a KDF like this based on standard
>assumptions about a MAC?
>[...] MACs are by design secure only if the
>key is pseudorandom, aren't they?

Yes, in general, you are right.  The fix is to pre-hash the key.
So you might use F(S,X) = SHA256-HMAC(SHA256(S), X), where S is the
secret.

For HMAC, it might just happen to be the case that pre-hashing is
unnecessary -- I don't know, and I haven't tried to do the analysis.

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: "Simon Blake-Wilson" <[email-masked]>
Date: Tue, 25 Oct 2005 15:11:50 -0400

Hi David,

Is there a proof somewhere that pre-hashing then MACing makes a good KDF?
I'd be interested to see it. In fact I'd settle for a good formal
definition of secure KDF ... Any pointers?

Best regards. Simon

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of David Wagner
> Sent: Tuesday, October 25, 2005 2:41 PM
> To: [email-masked]
> Subject: [Cfrg] Fwd: Hash-Based Key Derivation
> 
> 
> >assumptions about a MAC? [...] MACs are by design secure only if the
> Yes, in general, you are right.  The fix is to pre-hash the 
> key. So you might use F(S,X) = SHA256-HMAC(SHA256(S), X), 
> where S is the secret.
> 
> For HMAC, it might just happen to be the case that 
> pre-hashing is unnecessary -- I don't know, and I haven't 
> tried to do the analysis.
>