# Tag Info

4

CMAC(masterKey, i) should generally suffice, yes. Note that you would need to specify an encoding for i (e.g. octet string consisting of the big endian encoding of i, left-padded with zero valued octets up to 4 octets). It's probably better to implement one of the schemes defined in NIST SP 800-108: "Recommendation for Key Derivation Using Pseudorandom ...

3

The master key has to be stronger in the sense that it's more sensitive than session keys. The information used to derive session keys are not necessarily secret, so if it's easy to recover the master key, an attacker will be able to compute all the derived keys. On the other hand, recover a single session key will not help you to recover the master key ...

1

how does $A$ know $g^y$ to include in the formula above? Actually, what they mean here is, in fact, $g^y \bmod p$; that is, the value that $A$ received. It wouldn't work to insert the literal values $g^x$ and $g^y$; apart from the fact that $A$ doesn't know the second one, there's also the practical difficulty that since $x$ and $y$ are (perhaps) 256 ...

1

In general, you never want to use CRC/weak checksum for any computations on secret material (like keys). CRC is a linear function and by showing CRC of a key, you reveal a lot of equations that hold among the key bits. This is equivalent to showing the same number of bits of the key as the length of the checksum. The proper way of doing it has been ...

Only top voted, non community-wiki answers of a minimum length are eligible