I came across a piece of software that uses the following algorithm to generate a symmetric encryption key to encrypt data.
- Generate a non-secret 64 byte random string $M$ (fixed challenge)
- Generate a secret 20 byte random string $K$ (HMAC key)
- Compute $E = \operatorname{HMAC-SHA1}(K, M)$
$E$ is a 20-byte encryption key that is used to encrypt some data (with some well-known cryptographically secure algorithm). $M$ is kept alongside the data, while $K$ is separated from it and kept secret. Whenever data has to be accessed, $K$ is retrieved and the HMAC computation is repeated to re-generate $E$ and decrypt the data.
Is this algorithm secure, assuming that $E$ and $K$ are kept secret?