I have the first function that generates keys from AES decryption (128-bit key). It takes
seed as input:
derived_key_1 = AES-DEC(key, seed)
key are both fixed values that the attacker cannot changed. Attacker knows the value of
seed. His first goal is to get
He dooes have an extra capability. He has access to another function defined as follows:
temp_key = AES-DEC(key, chosen_seed) derived_key_2 = AES-DEC(temp_key, seed)
chosen_seed is controlled by the attacker. He can observed derived_key_2.
Assume the AES is implemented in hardware and AES primitive itself does not have timing side channel. Also attacker does not have other physical side channel (e.g., power, EM, fault, etc.) to observe other than timing of the two functions.
Are there any potential security concerns in this construction?
If there are problems, do the problems go away if I change the
seed in the second function to
seed_new which is still visible to the attacker, but not changeable by him.