# Key derivation using the main AES encryption key and some plain text?

I am using AES 128 bit encryption in java. I have an encryption key and 10 digit plain text.

I want to derive a key for HMAC using the AES encryption key and the 10 digit plain text. This plain text will remain fixed in my case.

How can I derive key for HMAC using the above ingredients.

To be more precise please refer below diagram:- How can I achieve to get a new key from the respective input.

• This is quite confusing. Why do you want a new key for HMAC? Also, there are many ways to "get a new key" from two inputs. You can use a key derivation function for example. Mar 2 '16 at 19:38
• HMAC has two inputs, so you use your existing AES key as one input and the plaintext as the other. Perhaps there is something that I don't understand (or it is too easy). The question is, what do you want to do with the New Key that you get out of? Also, the AES encryption key is usually the product of HMAC, not its input Mar 2 '16 at 19:39
• @d1str0 My requirement is that I need the existing AES key for encryption and the new key for signing the message before encrypting it. If there are other ways by which I can generate the key using the these two inputs then please let me know. I am using these two inputs because on the other end I want to recover the same key with the same inputs. Mar 2 '16 at 19:42
• Why are you signing before encryption? You should always encrypt then Mac. Mar 2 '16 at 19:43
• Ok, but still I need key for HMAC ? Mar 2 '16 at 19:46

NIST has defined some key derivation functions, which can be used to derive new key using one of NIST recommended MAC algorithms, AES-CMAC or HMAC. These functions can meet your needs.

The functions are defined in NIST SP 800-108: Recommendation for Key DerivationUsing Pseudorandom Functions.

Because you intent to use AES Encryption Key for encryption using AES algorithm, you need to pick key derivation mechanism that does not use AES algorithm in ways which may conflict with your use of the key. To do this, you may choose to use the functions with HMAC algorithm, for instance with SHA-256 hash function. (Do not choose AES-CMAC.)

When using construct (Counter Mode KDF, Feedback mode KDF or Double-Pipeline KDF) from NIST SP 800-108, the plaintext can be e.g. Label and the AES encryption key needs to be the KI. For instance:

Use KDF in Counter Mode, with

• h = the length of HMAC key desired
• r = 1
• KI = AES encryption key
• Label = the 10 digit plain text
• Context = empty string or suitable identifier identifying your protocol or key use purpose.

BTW, instead of deriving HMAC key from the AES encryption key, it is more common to use key derivation key to derive all required key material, i.e., to use KDK (Key Derivation Key), which derives enough key material for both the Encryption Key and the HMAC Key. This practice is recommendable because then encryption key is not used for two different purposes: encryption and key derivation. Use of keys for multiple purposes is generally considered back practice as it increases ways possible attacker may try to get information about the key.

I.e. I would recommend you to consider this instead

AES-CTR-KDK(KDK, plaintext-key) = AES-key (first 128-bits) || HMAC-key (last 256-bits).

[These are typical key sizes, customize the key sizes according to your needs.]

Furthermore, when proposing KBKDF (key-based key derivation function) I'm assuming your use of 10 digit plaintext is not used as PIN for authentication purposes. Then be careful, as it might be possible for attacker to brute-force the key space of $10^{10}$.

• Thx for your answer. I will try to implement this. Mar 2 '16 at 22:11
• I think this answer explains all points very well, but In my opinion your text (10 digit) should be introduced in Context. This point is explained in 7.5 and 7.6 of NIST SP 800-108: Recommendation for Key Derivation Using Pseudorandom Functions. Jan 1 at 10:22

I recommend HKDF - it's a key-based key derivation function (as opposed to password-based). It accepts an already-high entropy input (your AES key), a salt (you could use your "plain text"), and optional info, for contextualizing the key. It would be better to use your main key to derive two separate keys, one for encryption, and one for HMAC... and using the info parameter to distinguish the two keys.

In this case, this answer also should be a comment (I'm sorry!). @Hunter, the NIST SP 800-108 define the use of hmac as PRF. For example, in python, you can use:

hash_algo = hashes.SHA512()
kdf = KBKDFHMAC(algorithm=hash_algo,
mode=Mode.CounterMode,
length=32,
rlen=4,
llen=4,
location=CounterLocation.BeforeFixed, label=label,
context=context,
fixed=None,
backend=backend)

derived_key = kdf.derive(keyMaster)


As you can view, you have a option the select the algorithm hash. The package used is cryptography.hazmat.primitives.kdf.kbkdf, that includes KBKDFHMAC.

Regards