Subject: [Cfrg] Fwd: Hash-Based Key Derivation

From: David Wagner <[email-masked]>
Date: Tue, 25 Oct 2005 12:48:01 -0700 (PDT)

Simon Blake-Wilson writes:
>Is there a proof somewhere that pre-hashing then MACing makes a good KDF?

In the random oracle model, it is easy to prove that pre-hashing then
applying a PRF makes a good PRF.  In other words, let
    F'(S,X) = F(H(S),X)
where F is a PRF (when its key-input is uniformly distributed) and H is
a random oracle.  Then F' is a PRF, even when its secret-input S is not
uniformly distributed, so long as S has sufficient min-entropy.  Finally,
the latter is all you need to build a good KDF.

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: "Simon Blake-Wilson" <[email-masked]>
Date: Tue, 25 Oct 2005 16:59:44 -0400

Thanks David ... interesting stuff. You clearly have a clear idea of what
you think a KDF does in terms of security, but I guess I'd still like to
see a convincing formal defintion. (I guess this is hard to do since
"convincing" implies that the definition somehow helps convert an insecure
key establishment protocol into a secure one.)

Also if making random oracle model assumptions is OK, then the definition
in the I-D is also likely to be good, isn't it? For example, won't H(S|X)
also be a good KDF if H is assumed to be a random oracle?

Best regards. Simon

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of David Wagner
> Sent: Tuesday, October 25, 2005 3:48 PM
> To: [email-masked]
> Subject: [Cfrg] Fwd: Hash-Based Key Derivation
>
>
> In the random oracle model, it is easy to prove that
> pre-hashing then applying a PRF makes a good PRF.  In other words, let
>     F'(S,X) = F(H(S),X)
> where F is a PRF (when its key-input is uniformly
> distributed) and H is a random oracle.  Then F' is a PRF,
> even when its secret-input S is not uniformly distributed, so
> long as S has sufficient min-entropy.  Finally, the latter is
> all you need to build a good KDF.
>