Subject: [Cfrg] Derivation of an AES key from hash function (SHA-1, 256, 512)

From: ngaga Gisse <[email-masked]>
Date: Mon, 17 Jul 2006 09:21:46 -0700 (PDT)

Dear Sir,
  I have the following problem:
  I propose to use the hash function output as an input to the AES algorithm.
  The output of the AES is used to encrypt message M. 
   
  Question:
  1) I want to use a hash output (e.g. 160 bits stream) as an input to the the AES algorithm  1) I want to use a hash output. What techniques should be used to match the hash ouput and the AES input ?,  Or what actually should be done?
  2) Question1, but Hash(160 bits) ouput  less than the AES (192 bits) input. 
  3) Are there any known functions that can solve the problem? 
   
  Kind regards,
  Ngaga

 __________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg

---

From: "Hal Finney" <[email-masked]>
Date: Mon, 17 Jul 2006 10:00:02 -0700

Here's what I would suggest.

1. If the hash function output is the same size as the AES key, use it directly.

2. If the hash function output is bigger than the AES key, use a
subset of bits of the hash function, for example the leftmost bits.

3. If the hash function output is smaller than the AES key, get a
bigger hash function. There are several 256-bit hash functions in use
that will be big enough for the largest AES key. Probably the best
known is SHA-256.

Hal Finney

---

From: David McGrew <[email-masked]>
Date: Mon, 24 Jul 2006 04:36:09 -0700

Hi Ngaga,

On Jul 17, 2006, at 9:21 AM, ngaga Gisse wrote:

> 1) I want to use a hash output (e.g. 160 bits stream) as an input  
> to the the AES algorithm  1) I want to use a hash output. What  
> techniques should be used to match the hash ouput and the AES  
> input ?,  Or what actually should be done?

In this case, you could run the hash function in counter mode: invoke  
the hash function multiple times, and include both a secret value and  
a 32-bit number in each invocation of the hash function, which  
increments once between each invocation.   See http://www.ietf.org/ 
internet-drafts/draft-dang-nistkdf-01.txt for example.

I'm assuming that what you're doing is deriving an AES key from some  
other secret value.

David