# Good key update algorithms for key evolving schemes

In schemes like SAKE(Symmetric-key Authenticated Key Exchange) , the master keys (used to authenticate parties and generate session keys) are evolving, ie undergo transition $$K=update(K)$$.

• What is a good candidate for $$update(.)$$ function?

• Would $$K=\operatorname{AES}(K, S)$$ have "good properties", with $$S$$ being arbitrary block-length constant?Author of the algorithm state that $$update(.)$$ should be irreversible function.

• Maybe my notation was not clear. By $K_{new}=AES(K_{old}, S)$ I mean encrypting by AES using $K_{old}$ in the role of a key and arbitrary constant block $S$ in the role of an input block. Is this usage of AES reversible, i.e. is it possible to retrieve the old key from knowing the new one ? The reason I ask it because I implement it on STM32 MCU where the only HW accelerated algo is AES. It goes without saying that CPU is limited here, and taking advantage of HW acceleration is hugely beneficial. – Rachotilko Aug 3 at 10:20
• I'd rather use AES-CMAC in that case, also a PRF, although a software based HMAC might also be a secure option. Of course getting the old key from the new one would not be possible. However, getting $S$ using both keys is. – Maarten Bodewes Aug 3 at 10:40