2
$\begingroup$

I have a requirement to generate and share unique symmetric keys for a large numbers of small data objects.

In many cases the storage and retrieval of the key for each object will be a significant overhead, and often larger than the individual data objects they secure, so am looking for a strategy that mitigates this.

I am wondering if I could securely distribute a single master key for sets of these data objects, and then use a unique salt to derive a key for each data object. The salt would then be shared to allow a recipient to derive the same key for that object.

Every time the data changes for a specific object I would generate a new salt, derive a new key from the master key, re-encrypt the data and share the new salt. Sharing a new (say 96 bit) salt for each object would be significantly smaller than sharing an entirely new key.

(I am making the assumption it would be more efficient for the recipient to receive a new salt and derive the key, rather than receiving and importing a key for each object)

Update to add more info:

  • The design is such that these data objects might run into the the many 10s of millions, at a guess mostly < 200-300 bytes in size.
  • The data objects are unrelated, and will be accessed randomly by any number of recipients. The set of data objects any one recipient may access is unknown at creation time.
  • Access times to the plaintext of these data objects is significant, as is their over-wire cost
  • The server verifies access tokens presented for the data object, but beyond a signature has no knowledge of ownership or the content of them.
  • A single recipient may have access to 100s or 1000s of these objects, such that storing & retrieving unique keys for each is undesirable
  • Access to one data object shouldn't convey access to another
$\endgroup$
  • 1
    $\begingroup$ This sounds basically fine, if the only way you use the master key $k$ is to derive subkeys $k_i=\operatorname{PRF}_k(\mathit{salt}_i)$, provided you choose the salts sequentially so they're guaranteed never to repeat. An obvious choice for PRF would be HKDF-SHA256, though beware that what you call the per-object salt should be the ‘info’ parameter to HKDF-Expand, and the ‘salt’ for HKDF-Extract should be a string unique to an instance of your application. It would be helpful if you made clearer your security model—adversary's powers and security goals—and your performance constraints, though! $\endgroup$ – Squeamish Ossifrage Jul 12 '18 at 6:38
  • $\begingroup$ Thanks Squeamish - updated the Q with some more info $\endgroup$ – Neil Jul 12 '18 at 7:38

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.