I want to derive a 256 bit encryption key and a 256 bit MAC key from a single 256 bit master key for an authenticated encryption scheme.
I was considering the following construction to derive the two keys using a secure 256 bit hash algorithm e.g. Keccak:
- Key 1 for encryption = H(master key | '0')
- Key 2 for MAC = H(master key | '1')
The advantage of this is that if the MAC key is compromised, it will not lead to decryption of messages as it should be hard to find a pre-image for the one-way hash to determine the master key and thus the derived encryption key.
Also, if only the encryption key was compromised, then this would also not compromise the master key so the attacker should not be able to determine the MAC key and be able to forge future transmissions.
Is this a secure method to derive two keys from one key? If not, what is a more secure method?