# Is it secure to cascade KDFs

I would like to know if the following process to generate keys for a set of devices is secure.

Let’s say I have a 128-bit master key MK with high entropy. I use a KDF to generate a 128-bit device key DK for each device:

DK1 = KDF(MK, salt1)
DK2 = KDF(MK, salt2)
…


where the salt is, for example, the serial number of the device.

The device key is assigned to the device. They use their Device Key and the same KDF to produce message keys with 128bit:

K1 = KDF(DK1, mc)


where mc is a message counter.

The key is used for encryption or CMAC authentication.

When the devices communicate with the back end system, the back end can derive the K1 by

K1 = KDF( KDF(MK, salt1), mc)


Is this secure? The proposal for the KDF is CMAC according to NIST/SP 800-38B.

• Think of it like this: If you don't trust the KDF, does it make sense to use it at all? If you do trust it, then using it twice has no practical security gains. – elithrar Feb 8 '17 at 13:46
• What do you hope to achieve by calculating the message keys? You won't really achieve forward secrecy, since you can recalculate them from the master- or device keys at all times. – mat Jul 4 '17 at 11:51