# Using only pseudorandom function to drive many deterministic keys

My question is related to:

Can Pseudorandom values be used as secure keys?

But here I'm only using pseudorandom function.

Assume we have a pseudorandom function, $PRF$. We have a truly random master key: $mk$ for the PRF function.

I want to deterministically generate $n$ keys, so I do:

$\forall i, 1\leq i\leq n: k_i=PRF(mk,i)$.

Question: Is it secure to use each key $k_i$ to generate $m$ pseudorandom values? E.g. $\forall j, 1\leq j\leq m : k_{i,j}=PRF(k_i,j)$.

Is there any protocol using such scheme (if the scheme is secure) ?

Yes, what you suggest is essentially "KDF in Counter Mode" as defined in section 5.1 of SP 800-108 (pdf). That shows how to derive a long block of "derived key material" using a PRF in counter mode as you do. It includes some inputs for differentiating the context and length of the derived key for domain separation. You could use those, but if you only use this one key derivation procedure you can skip them.

Section 7.3 of the same document states that you can divide the derived material for keys as you like, as long as they do not overlap:

In the absence of limitations that may be imposed by relying applications, any segment of the derived keying material having the required length can be specified for use as a key, subject to the following restriction: When multiple keys (or any other types of secret parameters, e.g. secret initialization vectors) are obtained from the derived keying material, they shall be selected from disjoint (i.e., non-overlapping) segments of the KDF output.

I cannot think of a protocol that does this off the top of my head. E.g. TLS uses a more complex key derivation function, until 1.3 which is supposed to use HKDF.

Speaking of, you might want to use HKDF just because it is more standard, but what you are doing is fine too.

• Mind that this is essentially using the output keying material of the KDF to generate the keys. This is fine, but it's distinct from calling the KDF multiple times (for instance by including a canonical representation of the counter within the label). This should be kept in mind when using this to create a protocol (it might e.g. well be that you can only use a single call to a KDF to derive a single key in a hardware device such as a HSM). In that case the complete KDF as described in the NIST documents should be used anyway, of course. – Maarten Bodewes Aug 30 '16 at 8:05