International Association for Cryptologic Research

International Association
for Cryptologic Research

CryptoDB

Key Derivation and Randomness Extraction

Authors:
Olivier Chevassut
Pierre-Alain Fouque
Pierrick Gaudry
David Pointcheval
Download:
URL: http://eprint.iacr.org/2005/061
Search ePrint
Search Google
Abstract: Key derivation refers to the process by which an agreed upon large random number, often named master secret, is used to derive keys to encrypt and authenticate data. Practitioners and standardization bodies have usually used the random oracle model to get key material from a Diffie-Hellman key exchange. However, proofs in the standard model require randomness extractors to formally extract the entropy of the random master secret into a seed prior to derive other keys. This paper first deals with the protocol $\Sigma_0$, in which the key derivation phase is (deliberately) omitted, and security inaccuracies in the analysis and design of the Internet Key Exchange (IKE version 1) protocol, corrected in IKEv2. They do not endanger the practical use of IKEv1, since the security could be proved, at least, in the random oracle model. However, in the standard model, there is not yet any formal global security proof, but just separated analyses which do not fit together well. The first simplification is common in the theoretical security analysis of several key exchange protocols, whereas the key derivation phase is a crucial step for theoretical reasons, but also practical purpose, and requires careful analysis. The second problem is a gap between the recent theoretical analysis of HMAC as a good randomness extractor (functions keyed with public but random elements) and its practical use in IKEv1 (the key may not be totally random, because of the lack of clear authentication of the nonces). Since the latter problem comes from the probabilistic property of this extractor, we thereafter review some \textit{deterministic} randomness extractors and suggest the \emph{'Twist-AUgmented'} technique, a new extraction method quite well-suited for Diffie-Hellman-like scenarios.
BibTeX
@misc{eprint-2005-12398,
  title={Key Derivation and Randomness Extraction},
  booktitle={IACR Eprint archive},
  keywords={cryptographic protocols / Key exchange, Randomness extractors, Key derivation},
  url={http://eprint.iacr.org/2005/061},
  note={ David.Pointcheval@ens.fr 12861 received 25 Feb 2005, last revised 19 Mar 2005},
  author={Olivier Chevassut and Pierre-Alain Fouque and Pierrick Gaudry and David Pointcheval},
  year=2005
}