1
$\begingroup$

I want to do generate individual AES keys for a number of smart cards, based on a random master key (key diversification) and the serial number of the card.

According to the answers to this question HKDF is the/one way to go.

HKDF has three inputs, ikm, salt and info. Feeding in the serial number as part of ikm seems to be incorrect usage (and maybe dangerous because it makes the IKM less random?). That leaves salt and info, which one should I use?

$\endgroup$
  • $\begingroup$ I don't want to copy and paste for an answer, see section at 3.2 rfc5869 $\endgroup$ – kelalaka Mar 6 at 20:05
  • 2
    $\begingroup$ Possible duplicate of HKDF: ikm, salt and info values $\endgroup$ – Ilmari Karonen Mar 6 at 20:19
  • $\begingroup$ Unfortunately I don't even understand if these links argue in favor of "salt" or in favor of "info". $\endgroup$ – AndreKR Mar 6 at 20:30
  • $\begingroup$ From RFC5869: We stress, however, that the use of salt adds significantly to the strength of HKDF. In particular, info may prevent the derivation of the same keying material for different contexts. $\endgroup$ – kelalaka Mar 6 at 20:39
  • $\begingroup$ @kelalaka I should use salt because different info might not lead to different output keys, is that what you mean? $\endgroup$ – AndreKR Mar 6 at 20:43
3
$\begingroup$

If all you're using HKDF for is deriving subkeys from a uniformly random master key, you don't really need the Extract part of HKDF. So you can simply use your master key directly as the IKM input to HKDF-Expand, and the serial number (plus possibly other identifying information, if you e.g. may need to derive multiple keys per card) as the info input.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.