I have a Poly1305-implementation (not Poly1305-AES) in my library.

The difference: Poly1305-AES uses a key and a nonce and then uses AES to generate a one-time-key from key + nonce. This is necessary, because Poly1305 requires one-time-keys. However if you are generating a unique random key anyway, you can leave out the AES-part. (short source, original source)

My question: Is it secure to generate a unique one-time-key from a static key using another KDF with unique salt (like PBKDF2)?

(I think you could call this Poly1305-PBKDF2 or sth. like this)


Yes this would be secure.

Why would it be secure?
Because you would be running HMAC (the underlying primitive of PBKDF) as a stream-cipher using some key-derivation function.
As this is a common approach (at least for integrated encryption schemes) using this would at least as secure as using the bare KDF and a salt.

However I'd strongly argue against using PBKDF2 for anything but password-based key derivation and as a "stream cipher" it would give people a wrong sense of security (because it's 1000x slower = 10 bits more security).

If you want to use Poly-1305 I'd recommend you using a dedicated stream cipher (e.g. ChaCha20) or a dedicated stream cipher mode (e.g. CTR).

| improve this answer | |
  • Well ChaCha20 is also available in the lib, so I think I will use this. Thank you :) – K. Biermann May 3 '15 at 15:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.