Should I use independent symmetric keys for each client should I use keys derived from a master key?

Question

I have several clients that I communicate with from a central location. All connections are encrypted using static symmetric keys that are hard-coded in each client config file. I use a different key for each client because it is possible that someone gains access to the key of a client. In that case I want the attacker to be unable to access connections established by other clients.

Until now I was creating client keys manually by typing characters at random on my keyboard. I thought creating keys manually is not a good idea because in addition to being tedious it is error prone and somewhat insecure. So just now I was writing a key generator program that creates random keys for me.

But in the meanwhile another idea hit my brain: I can have just one master key and derive all client keys from it! For example suppose my master key is '123456', I can derive the first client key like this:

SHA256('123456'|'client1')

Is that OK?

Is it better to continue writing my key generator program and use separate and completely independent keys for each client or is deriving all keys from a master key acceptable?

Whatever approach I use, I need all client keys at a central controller location, so if an attacker gains access to this central location he has all the keys anyway, thus seems there is no advantage to using independent random keys for me.

P.S.: My master key is not something like '123456'; It is really/sufficiently strong!

Answer 1

Yeah, sure, you can derive keys from a master key. This is often performed for schemes using symmetric encryption primitives. And yes, including the ID of the client is generally the way to do this.

SHA-256 is not a brilliantly secure KDF - but in general it will do. You'd better use a real Key Based Key Derivation Function though. Currently HKDF is all the rage, which uses HMAC underneath. HMAC in turn can be configured using a secure hash such as SHA-256.

When starting from a secure master key you can directly use HKDF-expand (skipping HKDF-extract) where available.

---

Note that transport security requires extra care. In general you may want to bold on perfect forward secrecy (ephemeral Diffie-Hellman) or other key derivation techniques that create session keys from your client keys. You may also need a form of authenticated encryption using HMAC or an authenticated cipher such as AES-GCM.

Answer 2

The issue that I see unaddressed in your question is: why? When I look at your question, I can think of two general principles:

1. As a general rule, independent random keys are better than derived pseudorandom ones.
2. But we often use derived pseudorandom data in place of true random because there are practical challenges that would not be worth the effort and risk to overcome.

The extreme example of both points is the one-time pad: it is perfectly confidential because it uses random keys as large as the messages communicated, but for that reason it's also prohibitively impractical, so we don't use it.

In the case of keys, when derived keys are leaked they could be used to verify guesses for the value of the master key. A good key derivation function should make that sort of attack prohibitive, but in contrast, random keys make it all but impossible (assuming the random number generator is secure).

---

So you say that:

All connections are encrypted using static symmetric keys that are hard-coded in each client config file.

And:

So just now I was writing a key generator program that creates random keys for me. But in the meanwhile another idea hit my brain: I can have just one master key and derive all client keys from it!

So if all of the client keys are just going to be put into a file that will be distributed to each client, it doesn't seem like you gain anything at all from deriving these keys from a random master key instead of just randomly generating all of them independently (using a strong, cryptographic random number generator).

Maybe there's something missing from your description, but the point I'd stress is the following: key derivation is only better than random keys if it solves some practical problem that using random keys would have. So to justify the key derivation solution you really ought to articulate some argument to that effect.

---

Other than that, HKDF-expand would be a better choice than SHA-256, just as Maarten said.