Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Sure, that's what I was getting at with "a pass through the hashing function" though I could have been more specific. Again, I slightly prefer just using a single larger two-part key (or two separate keys) if reasonable, mostly out of a desire to require the minimum necessary cryptographic constructs.

But the point of my question wasn't necessarily to debate those two approaches as much as it was to politely bring up the detail of using independent keys for each cipher. I'm not sure I'd necessarily call it a footgun as much as I would call it proper hygiene.



I guess I'm just saying it would be super weird to see a modern cryptosystem share keys for any pair of constructions, because the standard pattern here is to start with some root secret (usually a DH agreement, maybe with a PSK mixed in) and then just HKDF out all the specific secrets needed to drive the rest of the system. I don't know of something that could really blow up if you used a Blake KMAC with the same key as ChaCha20, but if you saw that in a real design, you'd assume other things were wrong with it, right?


I would, but it was unstated in the original article which is why I wanted to bring it up.

XChaCha20+Blake3 as an encrypt-then-mac AEAD is just simple enough that people might think to wire it up themselves.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: