Score:3

Is the output of HKDF uniformly distributed, if my input is not?

tl flag

I have done some research on HKDF but I am still not sure about the security properties in different scenarios.

Which properties are fullfilled, when IKM and the salt are random and secret, but not uniformly random? Are the output keys uniformly random?

Which guarantees does HKDF give, if (a.) IKM or (b.) salt got leaked?

Is it also uniformly random, if no salt is provided at all?

Furthermore, is there any paper that clearly provides anwers to this question?

Thank you in advance!!

samuel-lucas6 avatar
bs flag
The OKM should be uniformly random regardless of whether you use a salt or not, but using any salt, especially random but even non-random, does improve the randomness extraction. Using a secret salt obviously improves the security as well because it's essentially like a pepper in password hashing or a pre-shared key. The best paper is probably the [HKDF paper](https://eprint.iacr.org/2010/264). I still haven't read it in full, so I may be missing something. I know the paper is somewhat different to the RFC regarding salt reuse, and the salt must not be attacker controlled.
Score:6
in flag

All the answers can be found in the original paper: "Cryptographic Extraction and Key Derivation: The HKDF Scheme" which is generally available.

Which properties are fullfilled, when IKM and the salt are random and secret, but not uniformly random? Are the output keys uniformly random?

They should be close to uniformly random yes, as the output of SHA-X is supposed to be uniformly random, assuming that the input isn't chosen deliberately.

The salt is generally not considered to be secret, although it can be.

Which guarantees does HKDF give, if (a.) IKM or (b.) salt got leaked?

If you leak both then you'd leak the output as well of course. As indicated, the salt is usually considered public. If you leak the IKM then the algorithm is deterministic, given a known salt, so an adversary can calculate the OKM.

Is it also uniformly random, if no salt is provided at all?

Again, unless the IKM is deliberately taken from a set known to produce specific results given a salt. The salt does make sure that domain separation takes place.

Furthermore, is there any paper that clearly provides answers to this question?

We can take this text from the HKDF paper:

Informally, a randomness extractor is a family of functions indexed by a public, i.e., nonsecret, parameter (which we refer to as "salt") with the property that on any input distribution with sufficiently high entropy, if one chooses a salt value at random (and independently of the source distribution) the output of the extractor is statistically close to uniform (see below for a formal definition). Moreover, this statistical closeness holds even if conditioned on the salt value.

p_1092131280 avatar
tl flag
Thank you for your helpful answer! "If you leak the IKM then the algorithm is deterministic, given a known salt, so an adversary can calculate the OKM." Let's say we have kept our salt secret and had it chosen randomly. What is the level of security the salt is protected with if an attacker has access to the output?
Maarten Bodewes avatar
in flag
Everything is behind HMAC which is a one-way function, so....
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.