Subject: RE: [Cfrg] Fwd: Hash-Based Key Derivation

From: "Blumenthal, Uri" <[email-masked]>
Date: Tue, 25 Oct 2005 16:07:23 -0400

> > Is there a proof somewhere that pre-hashing then MACing makes a good
KDF?
>
> In the random oracle model, it is easy to prove that pre-hashing then
> applying a PRF makes a good PRF. 

What properties of hash are assumed in this proof?

> In other words, let
>     F'(S,X) = F(H(S),X)
> where F is a PRF (when its key-input is uniformly distributed) and H
is
> a random oracle.  Then F' is a PRF, even when its secret-input S is
not
> uniformly distributed, so long as S has sufficient min-entropy.

Is it proven that hash function output is uniformly distributed?
Are most cryptographers OK with modelling hash functions as random
oracles?

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: "Tom Shrimpton" <[email-masked]>
Date: Tue, 25 Oct 2005 14:07:34 -0700

> Is it proven that hash function output is uniformly distributed?

Proven?  No, except of course in the random oracle model :)
You might like to look at Bellare and Kohno's paper "Hash Function Balance
and it's Impact on Birthday Attacks."

> Are most cryptographers OK with modelling hash functions as 
> random oracles?

For the purpose of proofs, (sometimes) yes, but not in practice.
The problem is that all of our existing hash functions are based on the 
Merkle-Damgard paradigm, but plain MD doesn't preserve random-oracle-ness.
There's a nice new paper by Coron, Dodis, Malinaud and Puniya 
"Merkle-Damgard Revisited: How to Construct a Hash Function" that addresses 
this issue.

-Tom