NIST SP800-56C r2 added Section 5.3 which specifically addresses using a single Extract step followed by m Expand steps using the same key-derivation-key produced in the Extract step.
This is a very common widely-deployed scenario (ex. processing master-key in Extract, then generating multiple derived keys with Expand to ex. encrypt multiple files, or multiple plaintext chunks/frames, etc. The number of such subsequent calls to Expand is either very large, and/or unknown (depends on the data being streamed/processed).
In all such cases, derived-key DKM-1 must be returned from KDF before deriving next key DKM-2 and the N for DKM-N is unknown (but could often be bounded by ex. 2^64).
The newly added Section 5.3 states the following:
The derived keying material,
DKM-1,DKM-2, ... , andDKM-mshall not be output until allmof the bit strings have been successfully computed. If an error occurs during randomness extraction or key expansion, then this key-derivation method shall not output any derived keying material.
Questions:
Why was Section 5.3 added? What is it trying to guard against (ie. is there a cryptographic or logical rationalization for it)? Does it prohibit using a single Extract followed by multiple Expand in a "streaming/online" manner, where Expand outputs are generated and used on as-needed basis (ie. not all at once)?
If Section 5.3 indeed forbids such a common scenario of online/streaming derivation of multiple Expand from a single Extract, how can we implement such a scenario (deriving multiple keys from a single non-uniform-entropy/unknown-entropy master-key) in a NIST-compliant way (a scenario that normally calls for a two-step KDF)?
