Problem - Kevin Tafuro

from a password. If you make key derivation take a tenth of a second, the user won’t
notice. However, if an attacker tries to carry out an exhaustive search of all possible
passwords, she will have to spend a tenth of a second for each password she wants to
try, which will make cracking even a weak password quite difficult. As we describe in
the sidebar “How Many Iterations?”, we recommend an iteration count of 10,000.
The actual specification of the key derivation function can be found in Version 2.0 of
the PKCS #5 standards document. In brief, we use a pseudo-random function using
the password and salt to get out as many bytes as we need, and we then take those
outputs and feed them back into themselves for each iteration.
There’s no need to use HMAC-SHA1 in PKCS #5. Instead, you could use the
Advanced Encryption Standard (AES) as the underlying cryptographic primitive,
substituting SHA1 for a hash function based on AES (see Recipes 6.15 and 6.16).
See Also
• RSA’s PKCS #5 page: http://www.rsasecurity.com/rsalabs/pkcs/pkcs-5/
• Recipes 4.9, 4.11, 5.26, 6.15, 6.16
4.11 Algorithmically Generating Symmetric Keys
from One Base Secret
Problem
You want to generate a key to use for a short time from a long-term secret (generally
a key, but perhaps a password). If a short-term key is compromised, it should be
impossible to recover the base secret. Multiple entities in the system should be able
to compute the same derived key if they have the right base secret.
For example, you might want to have a single long-term key and use it to create daily
encryption keys or session-specific keys.
Solution
Mix a base secret and any unique information you have available, passing them
through a pseudo-random function (PRF), as discussed in the following section.
Discussion
The basic idea behind secure key derivation is to take a base secret and a unique
identifier that distinguishes the key to be derived (called a distinguisher) and pass
those two items through a pseudo-random function. The PRF acts very much like a
142 | Chapter 4: Symmetric Cryptography Fundamentals
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.