I read the question Symmetric mutual authentication with client using a derived secret and its answer which, if I'm not mistaken, assert that it should be safe to use the proposed protocol for mutual authentication between a client A and a server B as follows:
- At commissioning, each client A gets a unique identifier $i_A$ and a derived key $k_A$ which is generated from the secret $s$ by HMAC($s$, $i_A$).
- To authenticate B, A sends $i_A$ and a random nonce $c_A$ to B.
- B calculates the expected derived key $k_A'$ = HMAC($s$, $i_A$) and replies with $r_B$ = HMAC($k_A'$, $c_A$) as well as a random nonce $c_B$.
- A can now authenticate B by comparing $r_B$ to HMAC($k_A$, $c_A$).
- To enable authentication of A with B, A sends $r_A$ = HMAC($k_A$, $c_B$) to B.
- Now B can authenticate A by comparing $r_A$ to HMAC($k_A'$, $c_B$).
Now I would like to use a single-block AES128 for the HMAC calculation in this scheme such that every message item (namely, $i_A$, $c_A$, $r_B$, $c_B$, and $r_A$) between A and B is exactly 128 bits long and the AES128 is used in ECB mode.