Key-dependent encryption in TAHOE-LAFS TAHOE-LAFS uses a form of "key-dependent encryption", in that a private key SK is encrypted with the truncated hash of the private key:

ENC(Htrunc(SK), SK)


Where Htrunc(X) is the result of SHA256(SHA256(X)), truncated to 16 bytes.

The TAHOE-LAFS paper states:


  This somewhat unusual arrangement means that the RSA signing key is encrypted with the truncation of the secure hash of itself. This is an instance key-dependent encryption, which is not as well-studied as we would like. However, we think that it would be surprising if there were a weakness in this construction which did not imply a weakness in the underlying standard primitives – RSA, AES-128, and SHA256.


What are the practical consequences of the use of this construction? Is the paper right in saying that if the underlying primitives are secure, this scheme should be secure as well?
There are no known dangers or attacks from this construction.  I agree with the quote from the TAHOE-LFS paper.  I would find it quite surprising if this use of the key material introduced some special weakness.  I can't prove it, but based upon my professional judgement, this is probably far from the biggest risk to your security -- it is very unlikely that this is the weakest link in the system.  It is far more likely that the weakest link is something else (e.g., endpoint security, the human processes, social engineering).  So, personally I wouldn't worry about this.