# Tag Info

As additional detail, while the two keys need to be distinct and secret, you can derive the CBC-MAC key and the CBC encryption key from the same master key. Generate a random master key, then use any key derivation algorithm with two different salts to derive the authentication and encryption keys. For example, $K(m, \text{'auth'})$ and $K(m, \text{'enc'})$ ...