Is it safe to use keys derived using HKDF or NIST sp800-108 with AES-CCM/GCM ? The NIST SP800-108 and SP*00-56C spec says "To comply with this Recommendation, the derived keying material shall not be used as a key stream for a stream cipher". AES-CCM/GCM using AES in CTR mode which is a stream cipher. Given the construction of the "expand" portion of HKDF and NIST SP800-108 is very similar/same, is it safe to use the key stream derived from these key derivation functions with these modes of AEAD ?
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
... the derived keying material shall not be used as a key stream for a stream cipher
Using the derived keying material as a key for AES-GCM is not the same as using the derived keying material as a key stream.
The quote means "don't xor the key material with the plaintext" as your entire encryption process.
AES-GCM does not xor the key with the plaintext. It uses it as the key for AES to generate a key stream, which is completely secure.
