# AES vs AES-CMAC for session key derivation

Assume two parties have exchanged a secret 128-bit Master Key, MK. When the two parties want to communicate, one of them generates a random 128-bit value, R, which is then sent in plaintext to the other party. Then, a KDF is used to generate a 128-bit Session Key, SK.

SK = KDF(MK, R)


SK is then used to encrypt communication between the parties. Let's say an authenticated encryption algorithm as AES-CCM is used with SK as input.

The question is: is there any difference between choosing a simple AES primitive and the more complex AES-CMAC as KDF?

• @bkjvbx what do you want me to do with the link? I don't care about the difference in output security between CBC-MAC and CMAC, I care about how that affects the strength of the derivation scheme where the output is kept secret and used to encrypt plaintext. – Bogdan Alexandru Aug 10 '16 at 14:53
• My apologies, I misread. As far as I can tell there would be no difference, since R is just one AES block. They may both be vulnerable to a related key attack, since an active adversary can modify R. Whether or not that is feasible is outside the scope of my knowledge. Is there any reason why you aren't using a hash-based KDF? – bkjvbx Aug 10 '16 at 15:45
• wiki.tools.ietf.org/html/… – bkjvbx Aug 10 '16 at 15:46
• @bkjvbx If comments are not necessary anymore then please delete them. Don't post single link comments unless it is immediately clear why they were posted and what they contain (probably best not post single link answers at all, especially since SE often crops them to a specific size). – Maarten Bodewes Aug 25 '16 at 9:05
• Neither function is really a KDF, let alone an extract-then-expand KDF. So you don't have the flexibilities that a true KDF supplies, such as differently sized input (Info or OtherInfo), differently sized output (try AES-192 keys for fun), labeling to generate different session keys. We're mainly concerned about security here, so I won't post this as an answer, but beware of the functional properties of your "KDF" as well. – Maarten Bodewes Aug 25 '16 at 9:15