Applied Cryptography
In protocols such as TLS 1.3, the shared secret obtained from an ECDHE key exchange is not used directly as an encryption key; instead keys are made by passing it through a key derivation function (KDF) such as HKDF. Which of the following is an appropriate reason?
- APassing it through a key derivation function makes the shared secret secure even against quantum computers
- BThe value from the key exchange is too short, so the computation is deliberately made slow to slow down brute force
- CThe value from the key exchange is not necessarily uniformly random, so it is turned into an unbiased key, and separate keys are derived for each purpose
Show answer and explanation
Answer: C. The value from the key exchange is not necessarily uniformly random, so it is turned into an unbiased key, and separate keys are derived for each purpose
The shared secret obtained from a key exchange is, for example, the coordinate of a point on an elliptic curve, and not all of its bits are necessarily uniformly random. HKDF uses HMAC first to extract an unbiased pseudorandom key from the shared secret (Extract), and then expands it together with labels such as "client-to-server encryption" (Expand) to make as many keys of the required lengths as needed. Using independent keys for each purpose keeps a problem with one key from spreading to other purposes. PBKDF2 and Argon2, which derive keys from passwords, are deliberately slow, but HKDF is a light operation that assumes an input with sufficiently high entropy.
- A. A key derivation function does not change how strong the key exchange itself is against quantum computers. Becoming quantum-resistant requires changing the key exchange scheme.
- B. Deliberately slow computation is the idea behind PBKDF2 and Argon2, which derive keys from passwords. The output of a key exchange already has sufficient length and entropy.
- C. Correct. Keys are made in two stages: Extract, which removes bias, and Expand, which makes a key for each purpose.