# Obtain 384 bits from a 256bit MasterSecret

I'm currently implementing, with crypto++, and AES tranmsission system, whose key is based on a previous MasterSecret of 256 bits (which has been expanded using PBKDF2).

This MasterSecret is then split into a key and an iv, to encrypt a message using AES-GCM.

I must work with AES-256, so my key must be 256-bit long. The iv for GCM is always 128-bit long.

So, briefly, I must extract from a 256-bit MasterSecret a 256-bit key and a 128-bit IV.

How to do it ?

I thought of taking the MasterSecret as the key, and then hashing the key to get then the iv of the desired length.

Is there a more efficient/elegant way to obtain 384 bits from a 256 bit MasterSecret ?

• Your method of IV generation seems dangerously flawed at first glance – Richie Frame Sep 17 '15 at 10:18
• @Richie - That's why I only thought of it ;) – EisenHeim Sep 17 '15 at 10:20
• Are you only using MasterSecret once? Then you can just use zero IV. – otus Sep 17 '15 at 10:24
• Yeah, it's just used to provide the keys for the AES. After that all communications will be encrypted with this key. Isn't it weaker for the security, to use a zero IV ? – EisenHeim Sep 17 '15 at 10:26
• Is there a good reason to require exactly 128-bit IV? The default IV length for AES-GCM is 96 bits. Larger IV lengths than that will be (a bit) less efficient. See NIST SP 800-38D, section 8 for some discussion on choosing IV for GCM. – user4982 Sep 17 '15 at 15:58

• HKDF ins't implemented yet in crypto++. I think I'll generate an iv every time I need one, without using bits of the MasterSecret. – EisenHeim Sep 17 '15 at 11:26
• Oh, didn't see that ! Thanks a lot ! And must the iv be the same for the two users ? I'm a bit confused. If I generate a new iv each time I encrypt a message, should I send the iv too ? – EisenHeim Sep 17 '15 at 12:39