HKDF, passwords, Bloom filters, Password-Authenticated Key Exchange (PAKE) and TLS 1.3 (Transport Layer Security)

Before ThisWhere Lecture 8 Left Off

Lecture 8 ended with Hashed Menezes-Qu-Vanstone, an Authenticated Key-Exchange Protocol (HMQV): two parties can establish an authenticated session key over a public channel, with security stated in the Canetti-Krawczyk model (a formal model of authenticated key exchange). The output of those protocols is a group element or a shared secret, not yet the collection of independent keys a secure channel needs. This lecture supplies the derivation step and the main deployment.

This LectureWhat It Adds

The lecture defines key derivation functions and the extract-then-expand design of HKDF (HMAC-based key derivation function) with Keyed-Hash Message Authentication Code (HMAC). It then treats passwords as low-entropy secrets: attacks, entropy, passphrases and the Bloom filter used to reject dictionary passwords without storing the dictionary. Password-based encryption adds salt and stretching, and Password-Authenticated Key Exchange (PAKE) turns a password into authenticated key exchange. The final block is TLS (Transport Layer Security): history, attacks, the TLS 1.3 handshake, the pre-shared key variant and 0-Zero Round-Trip Time (RTT) replay in A Transport Protocol Running over UDP (QUIC).

A Key Derivation Function (KDF) converts an imperfect secret, usually the Diffie-Hellman value $g^{xy}$, into one or more keys. HKDF extracts a pseudorandom key with $PRK = \mathrm{HMAC}(salt, IKM)$ and then expands it in feedback mode with $T(i) = \mathrm{HMAC}(PRK, T(i-1) \mid info \mid i)$. The lab below implements the full SHA-256 (Secure Hash Algorithm with 256-bit output) version and reproduces the RFC 5869 (Request for Comments 5869) vectors.

Password entropy is the quantity an offline attacker respects: uniform The 95 Printable ASCII Characters (ASCII-95) gives 6.57 bits per character, alphanumeric gives 5.95, and natural-language passphrases give the language entropy rate. Those rates assume uniform generation; human-chosen passwords carry less, so their strength is estimated from leaked passwords. Bloom filters let a server reject dictionary passwords with a compact bit table and a controlled false positive rate, with no false negatives. The animation below inserts a six-word dictionary into a 64-bit table and shows a member query, a false positive and a true negative.

TLS assembles the chapter: ephemeral Diffie-Hellman for forward secrecy, signatures over the transcript for authentication, HKDF-style key derivation bound to the handshake and a record layer for traffic. TLS 1.3 removed the legacy cipher suites and handshake modes that kept earlier attacks alive. The animation below walks the (EC)Ephemeral Diffie-Hellman over Elliptic Curves or Finite Fields (DHE) handshake from ClientHello to application data.

1. Chapter 3 §10: Key derivation and HKDF. Know why hashing $g^{xy}$ directly is insufficient, and write the extract and expand equations. Run the RFC 5869 case 1 button in the lab and compare the Pseudorandom Key (PRK) and Output Keying Material (OKM).
2. §11: Passwords and entropy. Be able to compute bits per character for The 95 Printable ASCII Characters (ASCII-95) and alphanumeric alphabets, and convert a target bit count into a required length.
3. §12: Bloom filters. Learn the insert and query rules, the false positive probability $p = (1 - (1 - 1/N)^{kD})^{k} \approx (1 - e^{-kD/N})^{k}$, the fact that false negatives never occur. Derive the optimal parameter formulas.
4. §13: Password storage, password-based encryption and Password-Authenticated Key Exchange (PAKE). Know the salted verifier, the PKCS #5 (Public-Key Cryptography Standard number 5) salt and stretching construction plus what EKE (Encrypted Key Exchange) encrypts under the password. State the PAKE guarantee that a recorded transcript cannot be used to test password guesses offline.
5. §14: TLS and TLS 1.3. Be able to name the flights of the TLS 1.3 handshake, the two authenticators $\sigma$ and $\tau$ plus the replay defense for 0-Zero Round-Trip Time (RTT) A UDP-Based Transport Protocol (QUIC).

• RFC 5869 (Request for Comments) HKDF (HMAC-based key derivation function) test case 1: compute PRK and OKM for the published inputs.
• Password entropy lengths: 128 bits under ASCII-95, alphanumeric and Italian entropy rates.
• Bloom filter sizing: optimal $k$ and $N$ for one million passwords at false positive rate $2^{-10}$.