0
$\begingroup$
  • It's best to use separate keys for encryption and the MAC.
  • Most implementations tend to derive a larger key and split it in two (e.g. scrypt with an output of 32 + 64 = 96).
  • Alternatively, you can generate one key and then use HKDF to generate a subkey for the MAC key.

How can you derive a MAC key using the encryption key without a salt? Or how can you derive a salt (for HKDF) given an encryption key and a nonce?

I know you can use HKDF without a salt but a) that's not as strong and b) I want the MAC key to be unique despite the same encryption key.

Lets say I want the user to only pass in an encryption key and a random or counter nonce.

$\endgroup$
7
  • $\begingroup$ Are you using only the salt to generate the AES-GCM key with HKDF? What is the source of the nonce? $\endgroup$
    – kelalaka
    Commented Feb 6, 2021 at 19:42
  • $\begingroup$ Lets assume the nonce is random or a counter. $\endgroup$
    – User
    Commented Feb 6, 2021 at 19:51
  • $\begingroup$ Those are different, if counter, once a value of the counter is leaked all is lost! If uniform random, then you can use it as a key if it has already 128-bit uniformly random. AES-GCM doesn't need random nonces, it can use counter based. $\endgroup$
    – kelalaka
    Commented Feb 6, 2021 at 19:57
  • $\begingroup$ You can use a counter nonce with GCM. $\endgroup$
    – User
    Commented Feb 6, 2021 at 19:58
  • 1
    $\begingroup$ You don't want to run a KDF from the encryption key. You'd want to run it from a master key and then derive an encryption key and a MAC key from that master key, possibly using a salt. If you'd use a salt at that time then both the encryption and MAC key are randomized and you don't need a nonce anymore; you can just set it to all zero. Note that scrypt also generally uses a salt; using a second salt is then not really needed. $\endgroup$
    – Maarten Bodewes
    Commented Feb 7, 2021 at 1:14

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.