NIST SP800-56C r2 added Section 5.3 which specifically addresses using a single Extract step followed by m Expand steps using the same key-derivation-key produced in the Extract step.

enter image description here

This is a very common widely-deployed scenario (ex. processing master-key in Extract, then generating multiple derived keys with Expand to ex. encrypt multiple files, or multiple plaintext chunks/frames, etc. The number of such subsequent calls to Expand is either very large, and/or unknown (depends on the data being streamed/processed).

In all such cases, derived-key DKM-1 must be returned from KDF before deriving next key DKM-2 and the N for DKM-N is unknown (but could often be bounded by ex. 2^64).

The newly added Section 5.3 states the following:

The derived keying material, DKM-1, DKM-2 , ... , and DKM-m shall not be output until all m of the bit strings have been successfully computed. If an error occurs during randomness extraction or key expansion, then this key-derivation method shall not output any derived keying material.


Why was Section 5.3 added? What is it trying to guard against (ie. is there a cryptographic or logical rationalization for it)? Does it prohibit using a single Extract followed by multiple Expand in a "streaming/online" manner, where Expand outputs are generated and used on as-needed basis (ie. not all at once)?

If Section 5.3 indeed forbids such a common scenario of online/streaming derivation of multiple Expand from a single Extract, how can we implement such a scenario (deriving multiple keys from a single non-uniform-entropy/unknown-entropy master-key) in a NIST-compliant way (a scenario that normally calls for a two-step KDF)?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.