My question is related to:

Can Pseudorandom values be used as secure keys?

But here I'm only using pseudorandom function.

Assume we have a pseudorandom function, $PRF$. We have a truly random master key: $mk$ for the PRF function.

I want to deterministically generate $n$ keys, so I do:

$\forall i, 1\leq i\leq n: k_i=PRF(mk,i)$.

Question: Is it secure to use each key $k_i$ to generate $m$ pseudorandom values? E.g. $\forall j, 1\leq j\leq m : k_{i,j}=PRF(k_i,j)$.

Is there any protocol using such scheme (if the scheme is secure) ?


1 Answer 1


Yes, what you suggest is essentially "KDF in Counter Mode" as defined in section 5.1 of SP 800-108 (pdf). That shows how to derive a long block of "derived key material" using a PRF in counter mode as you do. It includes some inputs for differentiating the context and length of the derived key for domain separation. You could use those, but if you only use this one key derivation procedure you can skip them.

Section 7.3 of the same document states that you can divide the derived material for keys as you like, as long as they do not overlap:

In the absence of limitations that may be imposed by relying applications, any segment of the derived keying material having the required length can be specified for use as a key, subject to the following restriction: When multiple keys (or any other types of secret parameters, e.g. secret initialization vectors) are obtained from the derived keying material, they shall be selected from disjoint (i.e., non-overlapping) segments of the KDF output.

I cannot think of a protocol that does this off the top of my head. E.g. TLS uses a more complex key derivation function, until 1.3 which is supposed to use HKDF.

Speaking of, you might want to use HKDF just because it is more standard, but what you are doing is fine too.

  • 1
    $\begingroup$ Mind that this is essentially using the output keying material of the KDF to generate the keys. This is fine, but it's distinct from calling the KDF multiple times (for instance by including a canonical representation of the counter within the label). This should be kept in mind when using this to create a protocol (it might e.g. well be that you can only use a single call to a KDF to derive a single key in a hardware device such as a HSM). In that case the complete KDF as described in the NIST documents should be used anyway, of course. $\endgroup$
    – Maarten Bodewes
    Aug 30, 2016 at 8:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.