Re: [Cfrg] On using ROs for analyzing randomness extraction functions

["D. J. Bernstein" <djb at cr.yp.to>]

There are both quantitative problems and qualitative problems with this
type of universal hashing. The most obvious quantitative problem is that
if you start with (e.g.) a 256-bit elliptic-curve g^xy, and hash it to a
(e.g.) a 256-bit key, then the leftover-hash lemma says _nothing_ about
the resulting distribution. The most obvious qualitative problem is that
real-world protocols reuse Diffie-Hellman keys with multiple parties,
forcing the key-derivation function to eliminate related keys, which
universal hashing fails to do.

---D. J. Bernstein, Professor, Mathematics, Statistics,
and Computer Science, University of Illinois at Chicago

_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg