Let's assume that we want to increase the lifetime of the master key. Can we do this by adding a key derivation step before the actual encryption? Assuming that we use the master key as input keying material and a random nonce in HKDF, can we extend the master key's lifetime?
Yes, certainly when it comes to the requirements of GCM anyway. There may of course be other considerations because the same master key is still protecting a possibly large amount of messages.
In other words, is
AES-GCM(HKDF(MasterKey, ...), IV, ...) offering any advantage regarding the total number of messages versus
AES-GCM(MasterKey, IV, ...)?
Potentially yes, it of course depends on the other inputs of HKDF, but as long as the input to HKDF is unique you have a secure one-way function that makes the derived keys independent of each other.
Specifically, assuming that HKDF has a fixed salt and random 128-bit nonce as input, and GCM uses a 96-bit random IV, then I assume that (WK, IV) have a lower collision probability than (IV).
There is no "nonce" defined as an input parameter to HKDF, but you can use one within the
A "fixed salt" is of little to no use. You can however use an empty salt parameter and use a nonce as part of the
Info parameter and be reasonably secure.
With a salt you don't have to think about domain separation (e.g. the use your master key for anything else that might interfere), source independent extraction (e.g. the possible repetition of the nonce or bad entropy of the master key) - but you can do without.
Actually, you can skip a step if you want and just use HKDF-Expand if your master key has enough entropy. In that case, there is no
Salt parameter required.
I would recommend having some additional constant string in the Info field that can also be used to derive keys from the master for additional use cases. For instance, the
Info field could use a label called
"EncapKey". This simply indicates what the use case of the derived subkeys is - it provides some domain separation.
If this assumption is correct, how does one go about calculating a bound for the master key's lifetime?
Let's assume that you output 256-bit keys and use at least SHA-256 as an underlying hash. Then the additional chance of collision can be considered negligible; it depends entirely on the collision properties of the nonce provided.
As indicated, there may be other reasons why you want to refresh your master key now and then, because the security of the messages still depends on that one single key.