# Using a derived key for CMAC

Consider the following authenticate-and-encrypt scheme that uses AES-128 in CBC mode for encryption and AES-128 - based CMAC for authentication:

1. Two keys are derived from the master key k (16 byte): SHA256(k) = k1 || k2 (k1 and k2 are each 16 byte long)
2. The plaintext x is encrypted using AES-128 and key k1: E_k1(x) = c
3. The CMAC is computed using AES-128 and key k2: CMAC_k2(x) = m
4. The result is the concatenation of the ciphertext and the MAC: c||m

We are asked to use this method and I am wondering if there are any problems with deriving the keys for the encryption and the MAC using SHA256 hash?

(I am aware of the discussion around authenticate-then-encrypt vs. encrypt-then-authenticate vs. authenticate-and-encrypt)

-

I see no reason why that would not be secure. If you want to play it safe, though, you could always go with a standardized key derivation function, such as HKDF (RFC 5869) or one of the other KDFs listed in this draft standard. (The draft itself seems to be expired, but it's the most convenient list of standardized key derivation functions I could find.)

-
In contexts where DPA or other side channel attacks are to be feared (Smart Cards, HSMs), there might be an issue with HMAC, or any other algorithm where secrets are hashed: the implementation of a the hash might not be designed/certified for side-channel resistance, when block ciphers typically are. This sometime is a reason to prefer block-cipher based KDF. –  fgrieu Jul 5 '12 at 16:53
+1 and good links for KDFs. Another one is this. –  SquareRootOfTwentyThree Jul 5 '12 at 20:36