Problem - Kevin Tafuro

cryptographic one-way hash from a theoretical security point of view, and indeed,
such a one-way hash is often good as a PRF.
There are many different ad hoc solutions for doing key derivation, ranging from the
simple to the complex. On the simple side of the spectrum, you can concatenate a
base key with unique data and pass the string through SHA1. On the complex side is
the PBKDF2 function from PKCS #5 (described in Recipe 4.10).
The simple SHA1 approach is perhaps too simple for general-purpose requirements.
In particular, there are cases where you one might need a key that is larger than the
SHA1 output length (i.e., if you’re using AES with 192-bit keys but are willing to
have only 160 bits of strength). A general-purpose hash function maps n bits to a
fixed number of bits, whereas we would like a function capable of mapping n bits to
m bits.
PBKDF2 can be overkill. Its interface includes functionality to thwart passwordguessing
attacks, which is unnecessary when deriving keys from secrets that were
themselves randomly generated.
Fortunately, it is easy to build an n-bit to m-bit PRF that is secure for key derivation.
The big difficulty is often in selecting good distinguishers (i.e., information that differentiates
parties). Generally, it is okay to send differentiating information that one side
does not already have and cannot compute in the clear, because if an attacker tampers
with the information in traffic, the two sides will not be able to agree on a working
key. (Of course, you do need to be prepared to handle such attacks.) Similarly, it is
okay to send a salt. See the sidebar, “Distinguisher Selection,” for a discussion.
The easiest way to get a solid solution that will resist potentially practical attacks is
to use HMAC in counter mode. (Other MACs are not as well suited for this task,
because they tend not to handle variable-length keys.) You can also use this solution
if you want an all-block cipher solution, because you can use a construction to convert
a block cipher into a hash function (see Recipes 6.15 and 6.16).
More specifically, key HMAC with the base secret. Then, for every block of output
you need (where the block size is the size of the HMAC output), MAC the distinguishers
concatenated with a fixed-size counter at the end. The counter should indicate
the number of blocks of output previously processed. The basic idea is to make
sure that each MAC input is unique.
If the desired output length is not a multiple of the MAC output length, simply generate
blocks until you have sufficient bytes, then truncate.
The security level of this solution is limited by the minimum of the
number of bits of entropy in the base secret and the output size of the
MAC. For example, if you use a key with 256 bits of entropy, and you
use HMAC-SHA1 to produce a 256-bit derived key, never assume that
you have more than 160 bits of effective security (that is the output
size of HMAC-SHA1).
Algorithmically Generating Symmetric Keys from One Base Secret | 143
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.