Best practices for key derivation

Summary: Trail of Bits audits frequently find improper uses of key derivation functions, and the post cites Flickr's API signature forgery vulnerability as a famous example of misusing a hash function during key derivation. It walks through HKDF's extraction and expansion steps, warns that attacker-controlled salts can break security, and notes that HMAC's PAD-or-HASH handling of variable-length keys makes certain salt choices exploitable.
Bottom line: In the post's example, a key management application that salts HKDF with a username lets an attacker who picks the username sha256(b"A"*65) obtain another user's keys - a single design choice that hands over the whole key set.

Read the original at Trail of Bits Blog ↗