Paper 2026/1150

The Key Control Security of KDF Combiners

Abstract

At CRYPTO 2025, Bhaumik et al. formalised the notion of Key Control (KC) security of Key Derivation Functions (KDFs). A KC adversary, on seeing the root key of a KDF, attempts to manipulate its auxiliary inputs (the `Context' string) to obtain a derived key from a pre-selected set of keys. In this paper we extend the notion of KC security to Key Combining Functions, which are KDFs that convert two root keys to a single derived key; we name the new notion Combining Key Control (CKC) security. We then investigate the CKC security of KDF Combiners and show that (up to certain limitations) it follows from the KC security of either of the component KDFs.

Note: [03/06/26] This version has minor additions to the accepted version at SCN 2026, primarily a full proof of Lemma 1. [09/06/26] This version corrects a typo in the author email address on the title page, as well as adds a proof that the second adversary used in the proof of Theorem 1 is valid. [30/06/26] This version corrects some alignment problems in Figures 3, 4, 5, and 6.