{"action":"created","issue":{"url":"https://api.github.com/repos/jedisct1/libsodium/issues/347","labels_url":"https://api.github.com/repos/jedisct1/libsodium/issues/347/labels{/name}","comments_url":"https://api.github.com/repos/jedisct1/libsodium/issues/347/comments","events_url":"https://api.github.com/repos/jedisct1/libsodium/issues/347/events","html_url":"https://github.com/jedisct1/libsodium/issues/347","id":126617724,"number":347,"title":"How to derive keys from high entropy input (other keys)","user":{"login":"FSMaxB","id":4294942,"avatar_url":"https://avatars.githubusercontent.com/u/4294942?v=3","gravatar_id":"","url":"https://api.github.com/users/FSMaxB","html_url":"https://github.com/FSMaxB","followers_url":"https://api.github.com/users/FSMaxB/followers","following_url":"https://api.github.com/users/FSMaxB/following{/other_user}","gists_url":"https://api.github.com/users/FSMaxB/gists{/gist_id}","starred_url":"https://api.github.com/users/FSMaxB/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FSMaxB/subscriptions","organizations_url":"https://api.github.com/users/FSMaxB/orgs","repos_url":"https://api.github.com/users/FSMaxB/repos","events_url":"https://api.github.com/users/FSMaxB/events{/privacy}","received_events_url":"https://api.github.com/users/FSMaxB/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-01-14T09:52:15Z","updated_at":"2016-01-14T12:56:48Z","closed_at":"2016-01-14T12:56:48Z","body":"`crypto_pwhash_scryptsalsa208sha256` can be used for key derivation, but as I understand it, this is mainly for deriving keys from low entropy inputs like passwords that can potentially be brute forced, so this function is designed to require many CPU cycles and much memory to make brute forcing harder.\r\n\r\nBut I want to derive a key from another key with a length of `crypto_secretbox_KEYBYTES` that already has high entropy, other than a password. So it should be safe to derive keys without the enormous computational effort.\r\n\r\nCan I use `crypto_pwhash_scryptsalsa208sha256` for that purpose? I would use a low `opslimit` (like 1), very few memory (don't know how much) and a constant salt (because the key derivation has to be deterministic). Is this safe to do, or maybe there's a better way to do this?\r\n\r\nMy current solution is [HKDF](https://tools.ietf.org/html/rfc5869) with `crypto_auth` as HMAC function."},"comment":{"url":"https://api.github.com/repos/jedisct1/libsodium/issues/comments/171637176","html_url":"https://github.com/jedisct1/libsodium/issues/347#issuecomment-171637176","issue_url":"https://api.github.com/repos/jedisct1/libsodium/issues/347","id":171637176,"user":{"login":"FSMaxB","id":4294942,"avatar_url":"https://avatars.githubusercontent.com/u/4294942?v=3","gravatar_id":"","url":"https://api.github.com/users/FSMaxB","html_url":"https://github.com/FSMaxB","followers_url":"https://api.github.com/users/FSMaxB/followers","following_url":"https://api.github.com/users/FSMaxB/following{/other_user}","gists_url":"https://api.github.com/users/FSMaxB/gists{/gist_id}","starred_url":"https://api.github.com/users/FSMaxB/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FSMaxB/subscriptions","organizations_url":"https://api.github.com/users/FSMaxB/orgs","repos_url":"https://api.github.com/users/FSMaxB/repos","events_url":"https://api.github.com/users/FSMaxB/events{/privacy}","received_events_url":"https://api.github.com/users/FSMaxB/received_events","type":"User","site_admin":false},"created_at":"2016-01-14T12:56:48Z","updated_at":"2016-01-14T12:56:48Z","body":"Ah, so that's what the subkey counter is for. Sorry, my bad."}}