Using a derived key for CMAC

Question

Consider the following authenticate-and-encrypt scheme that uses AES-128 in CBC mode for encryption and AES-128 - based CMAC for authentication:

1. Two keys are derived from the master key k (16 byte): SHA256(k) = k1 || k2 (k1 and k2 are each 16 byte long)
2. The plaintext x is encrypted using AES-128 and key k1: E_k1(x) = c
3. The CMAC is computed using AES-128 and key k2: CMAC_k2(x) = m
4. The result is the concatenation of the ciphertext and the MAC: c||m

We are asked to use this method and I am wondering if there are any problems with deriving the keys for the encryption and the MAC using SHA256 hash?

(I am aware of the discussion around authenticate-then-encrypt vs. encrypt-then-authenticate vs. authenticate-and-encrypt)

Answer 1

I see no reason why that would not be secure. If you want to play it safe, though, you could always go with a standardized key derivation function, such as HKDF (RFC 5869) or one of the other KDFs listed in this draft standard. (The draft itself seems to be expired, but it's the most convenient list of standardized key derivation functions I could find.)