Subject: KDF definition and goal [was: [Cfrg] Fwd: Hash-Based Key Derivation]

From: David Wagner <[email-masked]>
Date: Fri, 28 Oct 2005 10:08:29 -0700 (PDT)

Dan Bernstein writes:
>David Wagner writes:
>> The Leftover Hash Lemma requires that
>> the 2-universal hash be chosen randomly.  You have specified a scheme
>> where we use a single hash function that has been fixed in advance --
>> but then the Leftover Hash Lemma is not applicable.
>
>The hash function has to be chosen randomly, and has to be independent
>of all the other random choices in the protocol, but this doesn't mean
>that the choice has to wait until the last possible moment! A single
>random hash function can be standardized and reused for many keys.

The hash function also has to be independent of the adversary's choices.
If you pick and reveal the hash function first, and the adversary chooses
their values afterwards (and those values are processed with the hash
function you picked), all bets are off.  Did I get that right?

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: "D. J. Bernstein" <[email-masked]>
Date: 28 Oct 2005 21:47:22 -0000

> The hash function also has to be independent of the adversary's choices.

No, that sort of assumption is always wrong for public hash functions.
The adversary remains active after he sees the legitimate users' choice
of hash function.

> function you picked), all bets are off.  Did I get that right?

If you're trying to say that the attacker can perhaps produce non-random
behavior in the secret that he shares with you, that's true. In fact, he
always knows the entire value! But this has no relevance to his attempts
to determine the secret that you share with someone else.

---D. J. Bernstein, Professor, Mathematics, Statistics,
and Computer Science, University of Illinois at Chicago