Given: an AES-128 secret key (ASecKey) encrypts a file (CBC mode). (Assume good random)
Is is insecure to append (include) an HMAC-SHA1 of ASecKey to file?
Purpose: The receiver can then quickly verify if the shared secret key was used to encrypt.
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this communityGiven: an AES-128 secret key (ASecKey) encrypts a file (CBC mode). (Assume good random)
Is is insecure to append (include) an HMAC-SHA1 of ASecKey to file?
Purpose: The receiver can then quickly verify if the shared secret key was used to encrypt.
It's probably better to use a KBKDF as that doesn't need a key as input. You can use the KDF as key check value or KCV. If you use a block cipher based KBKDF from NIST SP 800-108 then you could reuse the AES algorithm to calculate the KCV.
You could however also make it easy for yourself and use a SHA-1 or SHA-2 over the key as KCV.
Note that the PKCS#11 method allows for calculating a KCV by encrypting a block of all zero's; this method should not be used.
To setup HMAC, you need a key. This key should be derived from ASecKey, for example by using HKDF. As input for HKDF, you supply Salt (does not have to be secret) + ASecKey. Then you generate entropy with HKDF (e.g. extract PRK and expand it). Use this entropy to obtain HMAC key. Then you can attach HMAC output to your file. When receiver wants to decrypt file, she supplies ASecKey, which is used to decrypt message and initialize HMAC. Without ASecKey, an attacker can't determine what key is used for HMAC. With HMAC, you can verify integrity of the encrypted message (you should encrypt, then HMAC). If you want to check whether supplied ASecKey is correct, you can use some of the HKDF output I described before as password validator sequence, which you attach to the file and check on decryption.