Extendable-output function: Difference between revisions

Revision as of 23:16, 22 June 2023

Revision as of 23:17, 22 June 2023

Line 6:

==Related-output issues==

By their nature, XOFs can produce related outputs (a longer result includes a shorter one as a prefix). The use of KDFs for key derivation can therefore cause related-output problems. As a "naïve" example, if the [[Triple DES]] keys are generated with a XOF, and there is a confusion in the implementation that causes some operations to be performed as 3TDEA (3x56 = 168-bit key), and some as 2TDEA (2x56 = 112 bit key), comparing the encryption results will lower the attack complexity to just 56 bits; similar problems can occur if hashes in the NIST [[SP 800-108]] are naïvely replaced by the KDFs.{{sfn|Perlner|2014|p=5}}

==References==