What is the most secure way to combine two "random" keys X of size k (k ≤ 512 bits) and Y of size 512 bits in one key Z of size k? Result Z will be used for encryption/decryption with various symmetric ciphers (most commonly with AES-256 in CBC mode) or as HMAC key (most commonly with SHA1 and SHA256).
There are two distinct use cases:
- a single Y will be combined with a single X (of size 512 bits) and resulting Z will be used many times
- a single Y will be reused many times with different X-es (with variable unknown size or various sizes) and resulting Z-s will be used
I know that simple XOR-ing is not a good idea, because in case 2. if a single X+Z pair will get compromised then Y also will be known to attacker.
Currently I think that a hash function (SHA-512) can be used on X || Y (|| denotes concatenation) and first k bits of the output can be used as Z. The only reason why I still haven't chosen this solution is due to fact that I want to lose as little entropy of key X as possible (and due to collisions in hash function some entropy may be lost).
Another idea is to use a symmetric cipher on X with Y used as key (most likely AES-256 in CBC mode without IV taking first k bits of output as Z). The only pro of this solution is, if X is 256 or 512 bits long then (due to bijectional nature of symmetric ciphers) no entropy should be lost.
I would like to get some opinions on this, may be there are some standard solutions/methods for this?