Domain Separation (cryptography)

In cryptography, domain separation is a construct used to implement multiple different functions using only one underlying template in an efficient way. The domain separation can be defined as partitioning of the domain of a function to assign separate subdomains to different applications of the same function.

For example, cryptographic protocols typically rely on random oracles (ROs, functions that return a value fully determined by their input yet otherwise random). The security proofs for these protocols are based on the assumption that the random oracle is unique to the protocol: if two protocols share the same RO, the assumptions of the proof are not met anymore. Since creating a new cryptographic primitive from scratch each time an RO is needed is impractical, multiple ROs (say, RO1 and RO2) are produced by prepending unique domain separation tags (DSTs, also known as ''domain separators'') to the input of a base oracle RO:
:RO1(x) := RO("RO1" , , x)
:RO2(x) := RO("RO2" , , x)
where "RO1" and "RO2" are the strings representing the unique DSTs and , , is a concatenation operator. If the underlying RO function is secure (say, it is a cryptographic hash), RO1 and RO2 are statistically independent. The technique was originally proposed by Bellare & Rogaway in 1993.

Uses

The domain separation construct can be used for multiple purposes:
* providing independent ROs for protocols;
* extending the output size of an RO (for example, by using the RO multiple times (numbered from 1 to L), each time using a representation of oracle number as a DST. This technique is called "counter mode" due to its similarity to the counter mode of a block cipher;
* "keying" the oracle by using an encryption key as a DST.
In the practical sense, the domain separation can provide "customization", an equivalent of the strong typing in programming: it enforces the use of independent calculations for different tasks, so an attacker that had learned a result of one calculation will get no information about another one.

Kinds of functions

Domain separation can be used with functions implementing different cryptographic primitives.

Hash functions

Domain separation is most commonly used with hash functions. The input domain of a hash function is practically unlimited, it is easy to partition it among any number of derived functions, for example, by prepending or appending of a DST to the message.

Domain separation is used within the implementation of some hash functions to produce multiple different functions from the same design. For example, in SHA-3 the domain separation makes sure that the differently named functions (like SHA3-512 or SHAKE128) are independent.

Symmetric ciphers and MACs

The security of symmetric ciphers and MACs critically depends on the key not being used for other purposes. If an application needs multiple keys but has only one source of keying material, it would typically employ a key derivation function to produce the keys. KDFs can usually produce output of arbitrary length, so they can be used to generate any number of keys.

Also, just like hash functions, some symmetric ciphers and MACs use domain separation internally.

Signatures

In many cases, it is desirable to use a single signing key to produce digital signatures for different purposes. If this is done, it is important to make sure that signed messages intended for one purpose cannot be used for the other. A simple way to achieve this is to add to each message an identifier specifying the purpose, and to reject a message if the identifier doesn't match.

References

Sources

*
*
*
*
*
*

Cryptography

{{Improve categories, date=January 2024