Consider the following authenticate-and-encrypt scheme that uses AES-128 in CBC mode for encryption and AES-128 - based CMAC for authentication:

  1. Two keys are derived from the master key k (16 byte): SHA256(k) = k1 || k2 (k1 and k2 are each 16 byte long)
  2. The plaintext x is encrypted using AES-128 and key k1: E_k1(x) = c
  3. The CMAC is computed using AES-128 and key k2: CMAC_k2(x) = m
  4. The result is the concatenation of the ciphertext and the MAC: c||m

We are asked to use this method and I am wondering if there are any problems with deriving the keys for the encryption and the MAC using SHA256 hash?

(I am aware of the discussion around authenticate-then-encrypt vs. encrypt-then-authenticate vs. authenticate-and-encrypt)


1 Answer 1


I see no reason why that would not be secure. If you want to play it safe, though, you could always go with a standardized key derivation function, such as HKDF (RFC 5869) or one of the other KDFs listed in this draft standard. (The draft itself seems to be expired, but it's the most convenient list of standardized key derivation functions I could find.)

  • 2
    $\begingroup$ In contexts where DPA or other side channel attacks are to be feared (Smart Cards, HSMs), there might be an issue with HMAC, or any other algorithm where secrets are hashed: the implementation of a the hash might not be designed/certified for side-channel resistance, when block ciphers typically are. This sometime is a reason to prefer block-cipher based KDF. $\endgroup$
    – fgrieu
    Jul 5, 2012 at 16:53
  • $\begingroup$ +1 and good links for KDFs. Another one is this. $\endgroup$ Jul 5, 2012 at 20:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.