This is the NIST SP 800 KDF in Counter Mode specification.

KDF in Counter Mode

Where $K_I$ is the input key, $[i]_2$ is the counter value, Label and Context are fixed-length strings and $[L]_2$ is the output size, the input to the PRF for each block $i\in n$ is as follows

$$K(i) := \operatorname{PRF} (K_I, [i]_2 \mathbin\Vert \mathit{Label} \mathbin\Vert \mathrm{0x00} \mathbin\Vert \mathit{Context} \mathbin\Vert [L]_2)$$

I'm trying to understand why

this Recommendation approves the use of either the keyed-hash Message Authentication Code (HMAC) specified in [8] or the cipher-based Message Authentication Code (CMAC) specified in [7] as the pseudorandom function.

Why not just use a straightforward PRP like AES here? Provided the fixed input data is of the correct width, I don't see why the complexity of using i.e. a CMAC PRF is being added to the construction.

Moreover, looking at the NIST CMAC specification and adapting it for one-block fixed-length inputs it seems the only difference would be XORing a second key with the input to the PRP.


1 Answer 1


The basic goal—not really explicated by the standard—of these KDF constructions is to turn an unstructured-input short-output PRF $f$ into a structured-input long-output PRF $\operatorname{KDF-}\!f$, whose PRF-advantage has some standard reduction to the PRF-advantage of $f$.

If the label, context, counter, etc., are all short enough, you could instantiate it with a PRP instead of a PRF for $f$, and you would incur the standard PRP-for-PRF cost on security bounds. It is likely that with CMAC, you don't pay that cost—though I haven't done the analysis to be sure.

  • $\begingroup$ I don't know where that HKDF suddenly came from; to my opinion it is obscuring the question - it certainly isn't present in the answer. Could you clarify that part? $\endgroup$
    – Maarten Bodewes
    Feb 28, 2018 at 12:04
  • $\begingroup$ I was reading and writing too fast and I forgot which choice of KDF the question was asking about by the time I got to that word. Fixed! $\endgroup$ Feb 28, 2018 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.