On The Security of Key Derivation Functions

Adams, Carlisle; Kramer, Guenther; Mister, Serge; Zuccherato, Robert

doi:10.1007/978-3-540-30144-8_12

Cited by 16 publications

(13 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A widespread consensus that an n-bit iterated hash function should never be expected to resist attacks requiring more than 2 n/2 operations. This would invalidate current uses of hash functions in cryptographic randomnumber generation, as in [KSF99,DHL02,Bal98], key derivation functions as described in [AKMZ04,NIST03,X963], and many other applications, and seems the least palatable outcome. 2.…”

Section: Using Generic Expandable Messagesmentioning

confidence: 99%

Second Preimages on n-Bit Hash Functions for Much Less than 2 n Work

Kelsey

Schneier

2005

Lecture Notes in Computer Science

245

271

View full text Add to dashboard Cite

Abstract. We expand a previous result of Dean [Dea99] to provide a second preimage attack on all n-bit iterated hash functions with Damgård-Merkle strengthening and n-bit intermediate states, allowing a second preimage to be found for a 2 k -message-block message with about k × 2 n/2+1 +2 n−k+1 work. Using RIPEMD-160 as an example, our attack can find a second preimage for a 2 60 byte message in about 2 106 work, rather than the previously expected 2 160 work. We also provide slightly cheaper ways to find multicollisions than the method of Joux [Jou04]. Both of these results are based on expandable messages-patterns for producing messages of varying length, which all collide on the intermediate hash result immediately after processing the message. We provide an algorithm for finding expandable messages for any n-bit hash function built using the Damgård-Merkle construction, which requires only a small multiple of the work done to find a single collision in the hash function.

show abstract

Section: Using Generic Expandable Messagesmentioning

confidence: 99%

Second Preimages on n-Bit Hash Functions for Much Less than 2 n Work

Kelsey

Schneier

2005

Lecture Notes in Computer Science

245

271

View full text Add to dashboard Cite

show abstract

“…Hash functions are often used to construct key derivation functions, e.g., [1,57,63,89,113,149,182]. It can be argued that some of these constructions are bad practice [1,113].…”

Section: Key Derivationmentioning

confidence: 99%

“…It can be argued that some of these constructions are bad practice [1,113]. However, hash functions do seem to be the natural primitive to use in the construction of a KDF.…”

Section: Key Derivationmentioning

confidence: 99%

“…The shift values used in the ShiftRows transformation are [1,2,4,10]. For these shift values, every message byte affects the entire extended state after four rounds.…”

Section: Grindahl-256mentioning

confidence: 99%

“…The shift values for ShiftRows are [1,2,3,4,5,6,7,8], which cause full diffusion after three rounds. MixColumns defines …”

Section: Grindahl-512mentioning

confidence: 99%

See 2 more Smart Citations

Cryptographic Hash Functions

Gauravaram¹,

Knudsen²

2010

Encyclopedia of Information Assurance

View full text Add to dashboard Cite

Cryptographic Extraction and Key Derivation: The HKDF Scheme

Krawczyk

2010

Lecture Notes in Computer Science

273

198

View full text Add to dashboard Cite

Abstract. In spite of the central role of key derivation functions (KDF) in applied cryptography, there has been little formal work addressing the design and analysis of general multi-purpose KDFs. In practice, most KDFs (including those widely standardized) follow ad-hoc approaches that treat cryptographic hash functions as perfectly random functions. In this paper we close some gaps between theory and practice by contributing to the study and engineering of KDFs in several ways. We provide detailed rationale for the design of KDFs based on the extractthen-expand approach; we present the first general and rigorous definition of KDFs and their security that we base on the notion of computational extractors; we specify a concrete fully practical KDF based on the HMAC construction; and we provide an analysis of this construction based on the extraction and pseudorandom properties of HMAC. The resultant KDF design can support a large variety of KDF applications under suitable assumptions on the underlying hash function; particular attention and effort is devoted to minimizing these assumptions as much as possible for each usage scenario.Beyond the theoretical interest in modeling KDFs, this work is intended to address two important and timely needs of cryptographic applications: (i) providing a single hash-based KDF design that can be standardized for use in multiple and diverse applications, and (ii) providing a conservative, yet efficient, design that exercises much care in the way it utilizes a cryptographic hash function. (The HMAC-based scheme presented here, named HKDF, is being standardized by the IETF.)

show abstract

On The Security of Key Derivation Functions

Cited by 16 publications

References 9 publications

Second Preimages on n-Bit Hash Functions for Much Less than 2 n Work

Second Preimages on n-Bit Hash Functions for Much Less than 2 n Work

Cryptographic Hash Functions

Cryptographic Extraction and Key Derivation: The HKDF Scheme

Contact Info

Product

Resources

About