NIST SP800-56C r2 added
Section 5.3 which specifically addresses using a single
Extract step followed by
Expand steps using the same key-derivation-key produced in the
This is a very common widely-deployed scenario (ex. processing
Extract, then generating multiple derived keys with
Expand to ex. encrypt multiple files, or multiple plaintext chunks/frames, etc. The number of such subsequent calls to
Expand is either very large, and/or unknown (depends on the data being streamed/processed).
In all such cases, derived-key
DKM-1 must be returned from
KDF before deriving next key
DKM-2 and the
DKM-N is unknown (but could often be bounded by ex.
The newly added
Section 5.3 states the following:
The derived keying material,
DKM-2, ... , and
DKM-mshall not be output until all
mof the bit strings have been successfully computed. If an error occurs during randomness extraction or key expansion, then this key-derivation method shall not output any derived keying material.
Section 5.3 added? What is it trying to guard against (ie. is there a cryptographic or logical rationalization for it)? Does it prohibit using a single
Extract followed by multiple
Expand in a "streaming/online" manner, where
Expand outputs are generated and used on as-needed basis (ie. not all at once)?
Section 5.3 indeed forbids such a common scenario of online/streaming derivation of multiple
Expand from a single
Extract, how can we implement such a scenario (deriving multiple keys from a single non-uniform-entropy/unknown-entropy master-key) in a NIST-compliant way (a scenario that normally calls for a two-step