Just for the hell of it... > Why use an HMAC instead of a KMAC? First, SHA-3 (and thus KMAC) isn't particularly performant without hardware acceleration, and

Just for the hell of it... > Why use an HMAC instead of a KMAC? First, SHA-3 (and thus KMAC) isn't particularly performant without hardware acceleration, and hardware acceleration (ASICs/special CPU instructions) isn't really available yet. So if you're not on an FPGA, KMAC will be slow. Second, SHA-3 isn't available as a builtin in most libraries, so it requires another import. Third, Blake2/Blake3 are faster in software and support similar MAC modes. So until hardware comes out with SHA-3 intrinsics that's a nicer alternative to HMAC. > Why would anyone want to derive a key? Lots of reasons! You might need to derive a fixed-size key from a passphrase. This requires a password-based KDF, like Argon2 or scrypt. You might need to derive a key from a field element like the result of a Diffie-Hellman exchange. The raw result isn't generally suitable for use as a key, since it's not likely the right size and might be biased. You might need to derive a sequence of keys from an initial value, say to provide forward secrecy like Signal's double ratchet algorithm. > When does it matter whether you use an integer or Galois field counter? Why bother calling it a GF when it's just binary anyway? These two questions are related. Fields are used because they satisfy certain mathematical properties that the integers don't. Galois fields are used because they don't require floating-point or rational values, everything within them is an integer (of some special representation). We call it a GF element instead of an integer because it's not just binary any more than a .jpg image is just binary. It's representing something specific, and the usual arithmetic operations are implemented differently for elements of a field than they are in general. Many systems store the (binary) coefficients of rather high degree polynomials in the bits of an integer, and then add & multiply polynomials. The results will be different than if you added or multiplied the relevant integers, the operations share a name but are not identical. Others use things like elliptic curve points (with an X & Y coordinate), which clearly aren't integers even if both coordinates are. > Why would I chose a protocol that used a symmetric cipher over an asymmetric one? Symmetric ciphers are much, much faster. Symmetric keys are much smaller. Symmetric ciphers tend to be far easier to implement safely, and far more resistant to cryptanalitic attack. They're generally just safer.