I would like to know if the following process to generate keys for a set of devices is secure.
Let’s say I have a 128-bit master key MK with high entropy. I use a KDF to generate a 128-bit device key DK for each device:
DK1 = KDF(MK, salt1) DK2 = KDF(MK, salt2) …
where the salt is, for example, the serial number of the device.
The device key is assigned to the device. They use their Device Key and the same KDF to produce message keys with 128bit:
K1 = KDF(DK1, mc)
where mc is a message counter.
The key is used for encryption or CMAC authentication.
When the devices communicate with the back end system, the back end can derive the K1 by
K1 = KDF( KDF(MK, salt1), mc)
Is this secure? The proposal for the KDF is CMAC according to NIST/SP 800-38B.