Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have this scenario where I use Encrypt-then-MAC (AES256-CBC and HMAC-SHA256) with keys generated by a CSPRNG (specifically, SecureRandom in Java). I'd like to know which is better:

  • Use the CSPRNG to generate two distinct keys of 32 byte each


  • Use the CSPRNG to generate a master key of 32 byte and then use HKDF to derive the encryption and authentication key

I'd like to add that no human interaction is involved: this keys are stored inside a DB and are only used by machines.

Thank you very much!

share|improve this question
up vote 2 down vote accepted

If you are concerned about database size, only the master key needs to be stored when you use HKDF. Ditto when sending it to another computer. Otherwise, two independent random keys are clearly secure and simpler to implement, so you should do that.

share|improve this answer
I'm not concerned about database size, nor to send keys to other computers, so I think I'll use two independent keys. Thanks – Marcello Jun 25 '14 at 12:42

If you are certain that SecureRandom is a trusted, verified CSPRNG you can use that without HKDF without problems.

share|improve this answer
AFAIK SecureRandom in Java is considered a CSPRNG. Do you think it's not? – Marcello Jun 25 '14 at 11:46
@Marcello, Java SecureRandom has been shown to be weak on some platforms (Android), and uses an "ad-hoc" construction based on SHA-1 rather than something standardized like HASH-DRBG or at least peer-reviewed like Fortuna.… – rmalayter Nov 25 '15 at 21:59
Thanks for your comment. This is a very important thing to know. – Marcello Nov 27 '15 at 1:02

Either is fine. If you're not concerned about database size or the size of transmitted keys, it doesn't matter which you choose. They are both secure. Choose whichever is more convenient, or easier to implement, or easier for others to interoperate with, or whatever other (non-security) criteria you might have.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.