Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to generate a key which would be good enough to be used for encryption with AES in a mobile environment. My idea is to use as a seed ''random attributes'' from a mobile device. Is hashing first this seed using HMAC construction (with some salt which is also random but public) and then use a HMAC-based Key Derivation function secure and efficient?

share|improve this question
What's wrong with just generating a random AES key? – otus Jul 25 '14 at 12:40
To add to what otus says, most operating systems have built in random number generators. Most mobile device platforms (iOS and Android) have good random number generators built in. Why not just generate a 128-bit (or 192 or 256) random value and use that directly? – mikeazo Jul 25 '14 at 12:42
Note that you have another question on here with the exact same title. – mikeazo Jul 25 '14 at 13:09
“…the best way…” is primarily opinion-based because there are several ways to handle this, and there is no general rule that makes the use of a HMAC a good KDF in all cases! – e-sushi Jul 25 '14 at 15:43
@Hashed, if the OS provides a secure random number source there's no need to preprocess that. You can just use it as a key directly. For example, /dev/urandom is such an interface, and most programming languages will make use of it (Java SecureRandom, Python SystemRandom). – otus Jul 25 '14 at 16:33

If you have plenty entropy in your "seed" then just use a KBKDF such as HKDF. If you have somewhat less, use a PBKDF such as PBKDF2. Both HKDF and PBKDF2 can take a salt as input parameter and are already using a HMAC internally.

There is no need to perform a HMAC beforehand. If you do, you would have to specify what data is used as key for the HMAC primitive.

If you just need a random key, use a well seeded CSPRNG (possibly just the one that the runtime supplies, the OS usually has most access to entropy sources).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.