Can any MAC be used as a KDF?

Question

First, let me clarify what I mean with a Key Derivation Function (KDF). I'm interested in KDFs that take an $n$-bit symmetric master key and some diversification data of arbitrary length as input and produce an $n$-bit symmetric key as output that can be used in subsequent cryptographic operations.

It seems to me that such KDFs have much in common with MACs:

• A key and data as input and an output that has the same length as the input key;
• The output should be unforgeable for an attacker who does not have access to the input key;
• The probability of producing equal outputs for unequal inputs should be negligible.

Hence my question: is it secure to use any secure MAC algorithm as a KDF?

Answer 1

No. A MAC guarantees unforgeability but not pseudorandomness. It is true that all MACs that I can think of right now are essential pseudorandom functions, but this does not mean that the MAC definition implies this. Indeed, it clearly does not.

So, conceptually, you need a pseudorandom function. You can assume that HMAC is a pseudorandom function. It is proven that CBC-MAC on prefix-free inputs behaves like a pseudorandom function. But this doesn't mean that it's always the case.

Answer 2

Like Yehuda Lindell already wrote, MAC does not imply PRF, which is pretty much what you would want from a KDF.

Additionally, some of your assumptions are not correct:

• A key and data as input and an output that has the same length as the input key;

This is frequently not the case with MACs. For example, when you use any MAC based on AES-256 (like CMAC, GMAC, Poly1305-AES) you will likely have at most a 128-bit authentication tag. And frequently much shorter tags are used, like by truncating the MAC to a desired length.

(KDFs often allow larger output, so that they can be used to derive multiple keys.)

• The output should be unforgeable for an attacker who does not have access to the input key;

This is true.

• The probability of producing equal outputs for unequal inputs should be negligible.

This is again not required and in fact often not the case – short MACs have non-negligible collision chance. Instead, outputs should be "unrelated", i.e. seeing some outputs cannot help forge others.

---

In practice many MACs are (believed to be) PRF. E.g. HMAC, CMAC, SipHash, etc. Most MACs based on a universal hash + a PRF are likewise PRF. So as long as the MAC output is large enough, you may be okay, but you should check the particular MAC that you are using.