Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I have a 512 bit master key, and 128 bit unique identifiers. I'm going to derive 256 bit keys to for use with deterministic and block ciphers.
For reference, The KDF I'm going to use is Hash( C | Z).
The implementation will be SHA256( uuid | master key).
I don't particularly care if SHA256 generates collisions as I never intend to store the derived key.
It think this will be fine, but would love a second opinion.
Yes, in practice this will be fine.
Expert cryptographers will give you grief and tell you that you should be using a PRF, and technically speaking, they will be right. So, if you want to spare yourself from having that conversation, replace SHA256 with a PRF, such as AES-CMAC or SHA256-HMAC or PBKDF2 (using the master key as the key and the uuid as the seed). This is the technically proper way to do it, and I'm thoroughly sympathetic with those who argue you should do it this way.
That said, even if you went ahead and used your original proposal (SHA256), you'd almost certainly be fine. So, if I saw you using SHA256 instead of a PRF, I wouldn't get too worried about it.
P.S. I see a lot of confusion in the comments. The following are not identical: PRF, MAC, HMAC.
The SHA-256 compression function compress a 256-bit chaining value and a 512-message block to an 256-bit output value. Let us assume that it is secure, i.e., collision and preimage resistance.
Then, you should at first hash the 512-bit master key and then then 128-bit uuid, since the first invocation compress the 512-bit master key and the 256-bit initial state to an unpredictable 256-bit chaining value X. In the following and final compression function call, X and the padded uuid is compressed to an 256-bit output value Y. Here, the unpredictability of X implies the unpredictability of Y.
SHA-256(master key | uuid) should do the trick, iff the internal compression function is ideal. Nevertheless, the construction looks a little bit fragile to me, since the SHA-256 compression function is most likely not ideal and the uuids only differ in a few bits. Therefore, I would recommend a much more conservative approach like SHA-256(master key | uuid | SHA-256(uuid)). In addition, you can increase the number of SHA-256 rounds, i.e., double or triple them.
