I have a system comprising N >1000 nodes. At each node I would like to use HKDF to derive a unique 256-bit key, Kn (for the nth node), from a pre-shared master key, K0, and a locally-generated random bit string, Rn.
Kn would then be used to apply AES-GCM to UDP packets that the nth node sends to other nodes and the receiving nodes would independently derive the necessary Kn using K0 and Rn, which would be included in the packet header and protected as “additional data” by the AES-GCM MAC.
The HKDF implementation takes the following parameters…
- Hash type: SHA256, SHA384, SHA512, BLAKE2B
- Input key of arbitrary length (presumably K0)
- “Additional Info” of arbitrary length (optional, but presumably Rn)
- Salt of arbitrary length (optional)
My questions are:
- What would be a good choice for the hash type?
- What is a sufficient length for K0?
- What is a sufficient length for Rn?
- What is the purpose / benefit / need of the optional Salt? Is it okay to omit assuming it can't be sent in the clear or pre-shared?
- Any other general flaws / issues / recommendations w.r.t. this approach?