Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Consider the following authenticate-and-encrypt scheme that uses AES-128 in CBC mode for encryption and AES-128 - based CMAC for authentication:

  1. Two keys are derived from the master key k (16 byte): SHA256(k) = k1 || k2 (k1 and k2 are each 16 byte long)
  2. The plaintext x is encrypted using AES-128 and key k1: E_k1(x) = c
  3. The CMAC is computed using AES-128 and key k2: CMAC_k2(x) = m
  4. The result is the concatenation of the ciphertext and the MAC: c||m

We are asked to use this method and I am wondering if there are any problems with deriving the keys for the encryption and the MAC using SHA256 hash?

(I am aware of the discussion around authenticate-then-encrypt vs. encrypt-then-authenticate vs. authenticate-and-encrypt)

share|improve this question
up vote 3 down vote accepted

I see no reason why that would not be secure. If you want to play it safe, though, you could always go with a standardized key derivation function, such as HKDF (RFC 5869) or one of the other KDFs listed in this draft standard. (The draft itself seems to be expired, but it's the most convenient list of standardized key derivation functions I could find.)

share|improve this answer
In contexts where DPA or other side channel attacks are to be feared (Smart Cards, HSMs), there might be an issue with HMAC, or any other algorithm where secrets are hashed: the implementation of a the hash might not be designed/certified for side-channel resistance, when block ciphers typically are. This sometime is a reason to prefer block-cipher based KDF. – fgrieu Jul 5 '12 at 16:53
+1 and good links for KDFs. Another one is this. – SquareRootOfTwentyThree Jul 5 '12 at 20:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.