In a recent question I asked here on crypto.se, an answer was given that surprised me a bit.
As mentioned in the referenced question, I'm looking to derive encryption and authentication keys from the output of scrypt. Since I can use nearly any output size I'd like in generating the output from scrypt. This leaves me two options for deriving the encryption and authentication keys:
- HMAC the output in two different ways, ie:
hmac(output, "e", sha256), hmac(output, "a", sha256); the
ekey is for encryption and the
akey is for authentication, unsurprisingly.
- Generate a very long output from scrypt by asking for a 512-bit output, and then split it for the key derivation for encryption and authentication.
Does any one solution fare better than the other in key derivation? I personally like the idea of using an HMAC better because then both the encryption and authentication keys use the entire key output as an input.