Which risks are associated with deriving multiple keys from the same DH secret Z?

Question

NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment.

NIST states in the same doc:

Each call to the randomness extraction step requires a freshly computed shared secret $Z$, and this shared secret shall be zeroized immediately following its use in the extraction process.

Why is it not recommended to derive multiple keys from the same $Z$, e.g. why not derive a key for data encryption and a key for authentication from the same $Z$ using different info strings? If I still do it, what weaknesses might the derived keys be facing? Is it simply bad practice (without deep explanation) to do so since the derived keys obviously are related? Krawczyk seems to think that multiple derivations from the secret are expected use (see section 3.2 in RFC 5869, my interpretation).

Does salting the HKDF with a good random salt change my risks when deriving multiple keys from a single $Z$?

Answer 1

A key derivation function is intuitively "purifying" the entropy in the group element Z into uniformly random (looking) bits that can used as a key for other purposes. It is not designed to produce "multiple keys" from the same Z, and one should definitely not call the KDF on the same Z twice (even with different salts) and expect to get two independent keys.

If you want more key material beyond the output of one call to the KDF, the high level approach should be to apply the KDF to Z only once to get a single key, and then apply a pseudorandom generator (e.g., AES in counter mode) to that key to get multiple keys. This approach will be sound in the sense that it can proven secure in an appropriate model, assuming Z is pseudorandom, the KDF meets a natural notion of "purifying," and the pseudorandom generator is secure.

Answer 2

There are two answers: the "engineering" answer, and the "principled" answer.

The engineering answer is that, in practice, if you generate two keys using two different info strings, I suspect you'd probably get away with it without problems. If we model the hash as a random oracle (admittedly a very strong "assumption"), then I suspect it might be possible to demonstrate that what you propose is OK. Disclaimers: I haven't analyzed this, and I'm certainly not going to give you any guarantees -- if you do what you propose, cryptographers will wag their finger and say "tsk, tsk", and rightly so. I suspect you'd probably get away with it (it's not the worst sin you could make), but if something does go wrong, cryptographers aren't going to take the blame -- it's all on you.

The more principled answer is that if you do what you propose, you are misusing the HKDF primitive. The HKDF is only intended to be applied to a single $Z$ once. It is intended to turn an unguessable value into something that looks uniformly random. It has been analyzed for that use. It was not designed to derive multiple keys from the same $Z$: it hasn't been analyzed for that kind of use case, since that's not what it was designed for. So, you're throwing away the benefits you could get from the public analysis of HKDF if you use it in a way that it wasn't designed for.

Consequently, given that it is so easy to apply a PRG or PRF to the output of HKDF (using HKDF to get a uniform-random key, and using a PRG or PRF for key separation, i.e., to derive two different keys), you should probably do that, instead of what you proposed. Given that it is so easy to do the principled things, you might as well do the principled thing, and use the HKDF only once on any given $Z$. Even though you could probably get away with cutting corners and doing what you proposed, I see no reason to take the risk (even if the risk is miniscule).

So, stick to using HKDF in the way that its specification tells you to. Don't cut corners. In this case, there's not really any compelling reason to deviate from standard cryptographic practice, so you might as well stick with what the specification and cryptographers recommend.