4
$\begingroup$

I would like to know if the following process to generate keys for a set of devices is secure.

Let’s say I have a 128-bit master key MK with high entropy. I use a KDF to generate a 128-bit device key DK for each device: 

DK1 = KDF(MK, salt1)
DK2 = KDF(MK, salt2)
…

where the salt is, for example, the serial number of the device.

The device key is assigned to the device. They use their Device Key and the same KDF to produce message keys with 128bit:

K1 = KDF(DK1, mc)

where mc is a message counter.

The key is used for encryption or CMAC authentication.

When the devices communicate with the back end system, the back end can derive the K1 by

K1 = KDF( KDF(MK, salt1), mc)

Is this secure? The proposal for the KDF is CMAC according to NIST/SP 800-38B.

Improve this question
$\endgroup$
2
  • 1
    $\begingroup$ Think of it like this: If you don't trust the KDF, does it make sense to use it at all? If you do trust it, then using it twice has no practical security gains. $\endgroup$
    – elithrar
    Feb 8, 2017 at 13:46
  • $\begingroup$ What do you hope to achieve by calculating the message keys? You won't really achieve forward secrecy, since you can recalculate them from the master- or device keys at all times. $\endgroup$
    – mat
    Jul 4, 2017 at 11:51

1 Answer 1

Reset to default
1
$\begingroup$

You can do this: essentially, if the initial key is uniform random and you use it for no other purpose, you can safely treat keys derived from it by distinct labels as independent uniform random from one another. The only danger is if you might accidentally use the same sequence of labels for two different purposes, which would be catastrophic. So make sure that each sequence of labels uniquely identifies the role that a key might be used for. (Formally, a KDF is a PRF, so if the key is uniform random, the output is hard to distinguish from uniform random.)

But what are you going to use mc for? Most authenticated ciphers, like AES-GCM, like AES-OCB, like NaCl crypto_secretbox_xsalsa20poly1305, etc., are designed to handle more than one message under a single key. Except for ‘SIV’ schemes which specifically don't conceal repeated messages, these all require some additional input to distinguish them—a random initialization vector, or a unique nonce. And if you aren't repeating message counters, a message counter makes an excellent nonce.

So while there's no problem with this as long as the labels uniquely identify key roles, you shouldn't need to do it—just use a standard authenticated cipher with the message counter as a nonce!

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.