Re: [Cfrg] KDF==MAC? and: how about HKDF-Poly1305? Re: Answers to HKDF questions

[Shai Halevi <shaih at alum.mit.edu>]

Blumenthal, Uri wrote:
> Please correct me if I'm wrong, but it seems that *in general*
> KDF based on a PRP primitive (such as AES) is clearly better than
> the one based on a weaker one (such as unkeyed hash, even extended
> to keyed MAC - where I have my own misgivings that are besides the
> point).

Seems quite wrong to me. From a theory perspective, neither PRFs nor
CRHFs would automatically make a good KDF (e.g., deal with high-entropy
but non-uniform inputs). Also, in theory CRHFs are *stonger* than PRFs,
not weaker. (You can build a PRF from a CRHF in a provable black-box
manner, but not the other way around.)

From a practical perspective, I don't see any reason to suspect that
an AES-based construction would give a better KDF than a construction
based on (say) HMAC-SHA2. If anything, it seems that the latter tends
to do better on most fronts.

Regards,

-- Shai