I have a system made of 2 or more parties, already sharing a master key
MK, who want to agree on a session key
SK (both 128-bit AES keys).
One of the parties (the master) starts the protocol by sending a random nonce authenticated by a MAC computed from a shared secret (derived from
MK). The request is also protected against replay by means of a counter.
The parties verify the request and compute a salt by concatening nonce, counter and MAC. Then, they use HKDF (rfc5869) based on SHA256 to derive
PRK = HMAC-SHA256(salt, MK) // HKDF-Extract T = HMAC-SHA256(PRK, info | 0x01) // HKDF-Expand SK = first 16 octets of T
Now, by protocol, each party has to prove that the derivation of SK from MK was successful, by authenticating fresh data with
SK. Assuming each party has a well-known fixed identifier, I build proof of possession as follows:
data = party_ID || salt proof = AES-CMAC(SK, data)
My question is: is it safe re-use the above salt as a "challenge" for proof of possession, or I have to force the master to send a new random nonce as challenge?
With "safe" I mean: assuming that the rest of the scheme is secure, does the fact of re-using the salt as a challenge leak some information about