Paper 2025/878
Blockcipher-Based Key Derivation without PRP/PRF Switching
, AWS, AWS, AWSAbstract
We examine the use of blockcipher-based key derivation beyond the birthday bound, arguing that the analysis step of PRP/PRF switching can be eliminated in many cases. To support this, we consider a modified ``ideal model'' for keying cryptographic applications in the multi-instance setting, where keys are chosen to be random \emph{but distinct}, rather than completely independent). Our analysis shows that typical cryptographic applications remain secure in this model. One consequence is that it is typically safe to derive close to $2^n$ keys using an $n$-bit blockcipher in counter mode. In particular, considering the practice of nonce-derived keys for authenticated encryption, our results imply that modes such as XAES-256-GCM that use CMAC-based key derivation are safe to use with more than $2^{64}$ distinct nonces.
Metadata
- Available format(s)
-
PDF
- Category
- Secret-key cryptography
- Publication info
- Preprint.
- Keywords
- GCMKey derivationPRPPRF
- Contact author(s)
-
fabrice benhamouda @ gmail com
shai halevi @ gmail com
kpanos @ amazon com
hugokraw @ gmail com - History
- 2025-05-19: approved
- 2025-05-17: received
- See all versions
- Short URL
- https://ia.cr/2025/878
- License
-
CC BY
BibTeX
@misc{cryptoeprint:2025/878,
author = {Fabrice Benhamouda and Shai Halevi and Panos Kampanakis and Hugo Krawczyk},
title = {Blockcipher-Based Key Derivation without {PRP}/{PRF} Switching},
howpublished = {Cryptology {ePrint} Archive, Paper 2025/878},
year = {2025},
url = {https://eprint.iacr.org/2025/878}
}
