I'm working on a secure file storage server. This server allows users to upload and download files based on a "seed". This "seed" is a 128-bit value.
From this 128-bit seed, we run SHA512 to derive a 256-bit key, 128-bit IV and 128-bit file identifier used to find the file on the server. The key and IV are then used to encrypt the file with AES in GCM mode. Only the file identifier is sent to the server at any point, encryption is done completely client side.
The only point at which I'm concerned here is the SHA512 of the 128-bit seed. Would there be any benefit to going to an HKDF based key expansion? It seems to be designed for this purpose, but considering we're able to achieve everything we need with a single invocation of SHA512 I'm unsure of the benefit. As far as I can tell, HKDF is still relying upon hash functions to randomly distribute entropy.
I understand there may be some theoretical benefit here, I'm just looking for details on how this benefit may work, what a theoretical attack might look like and if there's anything practical which could be used to exploit this today.