1
$\begingroup$

I am using AES128-CBC+HMAC for all encryption.

Currently I am using the same encryption and authentication/MAC key (Both derived from a master key with HKDF).

Assuming that forward secrecy is not a requirement for my project:

Is having a different session key each time strictly necessary and why?

Improve this question
$\endgroup$

2 Answers 2

Reset to default
2
$\begingroup$

No, having a different session key each time is not strictly necessary. The generic justification is that all modern ciphers and Message Authentication Codes, including AES128-CBC and HMAC, are specified to allow a key to be safely reused for multiple messages.

Note: the One Time Pad does not allow reuse of its pad/key for multiple messages, but is not an exception; it just does not match the modern definition of a cipher.

For CBC with a $b$-bit block, and fully random IV, the best generic attack (for chosen plaintext) requires that there is an accidental collision in the ciphertext blocks, and that has demonstrably odds less than $n^2/2^{b+1}$ to occur after $n$ blocks of $b$ bits have been encrypted. For AES, $b=128$, so if one enciphers less than $2^{60}$ octets (including padding) across all the sessions, residual odds of any attack due to CBC are demonstrably less than $2^{-17}$; and then that is only expected to compromise a few blocks of plaintext, or allow to test if the plaintext has some characteristic.

HMAC with any common hash (including the broken MD5) resists even better to multiple uses.

Still, there could be good reasons to change the key regularly, including being secure despite:

  • an insufficiently random IV for CBC (including, a narrow one, or one generated using a poor RNG, including a good PRNG that is poorly seeded);
  • leakage of key by some side-channel, including plain compromise of a machine using it;
  • guess of the MAC for a certain message that the attacker wants to be accepted, by some side channel like the archetypal timing attack allowed by comparison using memcmp;
  • a padding oracle attack.
Improve this answer
$\endgroup$
0
$\begingroup$

I think in this case there are no obvious drawbacks of such cryptosystem. E.g. PGP is used that way for many years: the same key for all messages. So, my answer is: no, it is not strictly necessary.

Yet there are advantages of using session keys except for PFS. Because often you are getting protection from replay attacks 'for free'.

Improve this answer
$\endgroup$
1
  • 2
    $\begingroup$ The conclusion is right, but the reasoning makes an apples-to-oranges comparison; namely, between the symmetric keys in the question, and the asymmetric keys in PGP. And in that common use of PGP, the symmetric key it also uses for AES are fresh for each file/session (for very imperative reasons in the PGP context, but not there). $\endgroup$
    – fgrieu ♦
    Commented Feb 17, 2017 at 12:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.