PKCS #11 – Deriving a Key where MSB perform encryption and LSB perform CMAC operation?

Question

I am using Thales HSM, a PKCS #11 Compliant device. I have an 32 byte AES key and derivation input.

I want to use AES-ECB encryption Mode to derive a 32 byte key where 16 MSB should be considered as one key, and 16 LSB should be considered as an another key. How do I achieve this?

I know that CKM_AES_ECB_ENCRYPT_DATA mechanism and C_DeriveKey PKCS #11 functions allow for derivation of keys using the result of an encryption operation as the key value. But my problem is how do I get 2 separated Keys (16 MSB and 16 LSB)?

This is very much needed for me to implement a System where 16 MSB perform Encryption operation, and 16 LSB perform CMAC operation.

EDIT

I am adding some more inputs to my query here.

Derived_Key = encrypt_Aes_Ecb(Master_Aes_Key, Derivation_Input) 

where Master_Aes_Key is a 32byte Key and

Derivation_input = Concatenate(Input1 , Input2)

Both Input1 and Input2 are 16bytes.

My understanding is, if

Derivation_input = Concatenate(Input1, 16B of Zeros) 

gives 16MSB of derived Key, and if

Derivation_input = Concatenate(16B of Zeros, Input2) 

gives 16LSB of derived_key. Am I correct?

EDIT 2

Sample Input1:

00 00 00 F0 00 00 00 00 00 00 00 00 WW XX YY ZZ 

Sample Input2:

00 00 00 0F 00 00 00 00 00 00 00 00 ww xx yy zz 

where WW, XX, YY, ZZ , ww, xx, yy, zz would be keep changing always.

Derivation Input: Concatenate(Input1, Input2) 
Derived_Key = encrypt_Aes_Ecb(Master_Aes_Key, Derivation_Input)

Now How do I get 16MSB of derived_key as one key used for encryption/decryption, and 16LSB of derived_key as another key used for CMAC operation?

Answer 1

OK so your problem is the following: You have a secure key and want to / can use it only for AES-ECB. You want to extend the security of this key to derived keying material which deterministically depends on some context material. Finally you need to derive a 32-byte key.

Now, one could use NIST SP800-108 (PDF) as guidance and use the counter-based construction. Here you would take the variable parts of your input, put them into the "fixed part" and run a counter for two blocks. So you would take the 8 variable bytes as the 8 most significant bytes to the ECB input and use the lower 8 bytes as a counter. So your input would be WW XX YY ZZ ww xx yy zz 00 00 00 00 00 00 00 00 and WW XX YY ZZ ww xx yy zz 00 00 00 00 00 00 00 01 and the first output block could be used for the encryption and the second for the MAC of the scheme.