I am using Thales HSM, a PKCS #11 Compliant device. I have an 32 byte AES key and derivation input.
I want to use AES-ECB encryption Mode to derive a 32 byte key where 16 MSB should be considered as one key, and 16 LSB should be considered as an another key. How do I achieve this?
I know that
CKM_AES_ECB_ENCRYPT_DATA mechanism and
C_DeriveKey PKCS #11 functions allow for derivation of keys using the result of an encryption operation as the key value. But my problem is how do I get 2 separated Keys (16 MSB and 16 LSB)?
This is very much needed for me to implement a System where 16 MSB perform Encryption operation, and 16 LSB perform CMAC operation.
I am adding some more inputs to my query here.
Derived_Key = encrypt_Aes_Ecb(Master_Aes_Key, Derivation_Input)
Master_Aes_Key is a 32byte Key and
Derivation_input = Concatenate(Input1 , Input2)
Input2 are 16bytes.
My understanding is, if
Derivation_input = Concatenate(Input1, 16B of Zeros)
gives 16MSB of derived Key, and if
Derivation_input = Concatenate(16B of Zeros, Input2)
gives 16LSB of derived_key. Am I correct?
00 00 00 F0 00 00 00 00 00 00 00 00 WW XX YY ZZ
00 00 00 0F 00 00 00 00 00 00 00 00 ww xx yy zz
WW, XX, YY, ZZ , ww, xx, yy, zz would be keep changing always.
Derivation Input: Concatenate(Input1, Input2) Derived_Key = encrypt_Aes_Ecb(Master_Aes_Key, Derivation_Input)
Now How do I get 16MSB of derived_key as one key used for encryption/decryption, and 16LSB of derived_key as another key used for CMAC operation?