Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I am using AES 128 bit encryption in java. I have an encryption key and 10 digit plain text.
I want to derive a key for HMAC using the AES encryption key and the 10 digit plain text. This plain text will remain fixed in my case.
How can I derive key for HMAC using the above ingredients.
To be more precise please refer below diagram:- How can I achieve to get a new key from the respective input.
NIST has defined some key derivation functions, which can be used to derive new key using one of NIST recommended MAC algorithms, AES-CMAC or HMAC. These functions can meet your needs.
The functions are defined in NIST SP 800-108: Recommendation for Key DerivationUsing Pseudorandom Functions.
Because you intent to use AES Encryption Key for encryption using AES algorithm, you need to pick key derivation mechanism that does not use AES algorithm in ways which may conflict with your use of the key. To do this, you may choose to use the functions with HMAC algorithm, for instance with SHA-256 hash function. (Do not choose AES-CMAC.)
When using construct (Counter Mode KDF, Feedback mode KDF or Double-Pipeline KDF) from NIST SP 800-108, the plaintext can be e.g. Label and the AES encryption key needs to be the KI. For instance:
Use KDF in Counter Mode, with
BTW, instead of deriving HMAC key from the AES encryption key, it is more common to use key derivation key to derive all required key material, i.e., to use KDK (Key Derivation Key), which derives enough key material for both the Encryption Key and the HMAC Key. This practice is recommendable because then encryption key is not used for two different purposes: encryption and key derivation. Use of keys for multiple purposes is generally considered back practice as it increases ways possible attacker may try to get information about the key.
I.e. I would recommend you to consider this instead
AES-CTR-KDK(KDK, plaintext-key) = AES-key (first 128-bits) || HMAC-key (last 256-bits).
[These are typical key sizes, customize the key sizes according to your needs.]
Furthermore, when proposing KBKDF (key-based key derivation function) I'm assuming your use of 10 digit plaintext is not used as PIN for authentication purposes. Then be careful, as it might be possible for attacker to brute-force the key space of $10^{10}$.
Context. This point is explained in 7.5 and 7.6 of NIST SP 800-108: Recommendation for Key Derivation Using Pseudorandom Functions.
$\endgroup$
Jan 1, 2021 at 10:22
I recommend HKDF - it's a key-based key derivation function (as opposed to password-based). It accepts an already-high entropy input (your AES key), a salt (you could use your "plain text"), and optional info, for contextualizing the key. It would be better to use your main key to derive two separate keys, one for encryption, and one for HMAC... and using the info parameter to distinguish the two keys.
In this case, this answer also should be a comment (I'm sorry!). @Hunter, the NIST SP 800-108 define the use of hmac as PRF. For example, in python, you can use:
hash_algo = hashes.SHA512()
kdf = KBKDFHMAC(algorithm=hash_algo,
mode=Mode.CounterMode,
length=32,
rlen=4,
llen=4,
location=CounterLocation.BeforeFixed, label=label,
context=context,
fixed=None,
backend=backend)
derived_key = kdf.derive(keyMaster)
As you can view, you have a option the select the algorithm hash. The package used is cryptography.hazmat.primitives.kdf.kbkdf, that includes KBKDFHMAC.
Regards
