Subject: KDF definition and goal [was: [Cfrg] Fwd: Hash-Based Key Derivation]

From: David Wagner <[email-masked]>
Date: Tue, 25 Oct 2005 17:07:59 -0700 (PDT)

David McGrew writes:
>Agreed, the KDF as stated would only be useful for deriving a set of  
>keys from a master key, and would not be useful for other problems.

The good news is that if you have a master key to start with, you
don't need anything fancy for deriving a set of keys: any ordinary
PRF does the trick (e.g., AES, AES-CBC, SHA256-HMAC, and so on).

>Sure, the random oracle model and KDFs based on it are well  
>accepted.  It would be nice to get something based on a reduction- 
>based proof, though.

Definitely.  It would be very nice.  The bad news is that I don't see
how to get there without the random oracle if we want to be general
purpose.  Perhaps someone else has some ideas.  If we can characterize
the distribution on the secret inputs, we can do better (such as the
Hash Diffie-Hellman assumption that DJB mentioned), but then of course
you don't have a general-purpose KDF scheme any more.

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg