2
$\begingroup$

I'm designing a scheme for management of a small number of cryptographic keys (< 100 at any given time) and I had an idea: rather than storing all the keys, could I just store one master key and use a KDF to derive the particular key I need by varying the salt in a certain way?

For example, if I need the second encryption key for usage X, I'd give something like PBKDF a salt of

$$2||“encryption”||X||<random value>$$

which would uniquely derive the second version of that particular key.

Improve this question
$\endgroup$
3
  • 1
    $\begingroup$ If your master key is already high-entropy (ie, 16+ bytes generated by a CSPRNG), I'd recommend HKDF. You can use the 'info' input to bind each key to an individual context (ie, a username, serial number, etc). $\endgroup$
    – hunter
    Jul 3, 2013 at 0:09
  • 1
    $\begingroup$ @hunter yes, in general a KBKDF should be preferred over a PBKDF. I've created an answer on this fact that also mentions the NIST 800-108 specification (which HKDF should improve upon according some claims I've read through very quickly). $\endgroup$
    – Maarten Bodewes ♦
    Jul 3, 2013 at 0:13
  • $\begingroup$ BouncyCastle has an implementation of HKDF. Thanks much everybody, this is very helpful. $\endgroup$
    – pg1989
    Jul 3, 2013 at 0:22

1 Answer 1

Reset to default
2
$\begingroup$

You should not use a Password Based Key Derivation Function (PBKDF) for this. Instead you need a Key Based Key Derivation Function (KBKDF). You could use for instance NIST SP 800-108 (PDF) or HKDF. Both specify means for key derivation using some kind of context which is used as input for the KDF (e.g. a label or sequence number).

A salt is used in a similar fashion in PBKDF, but a salt has a different purpose than context data. Furthermore, it is not that likely that you need key strengthening which is delivered by the salt and iteration count commonly used in PBKDF's. If your master key is strong enough, then the derived keys should be safe without additional measures. PBKDF's are deliberately slow, KBKDF's aren't.

Note that KDF implementations may not be that widespread. They are however relatively easy to compose using the MAC or HMAC primitives that supply the necessary PRF functionality. If you go that way, don't forget to test against the available test vectors though.

If you go for the NIST defined KBKDF's I would advice for a counter mode KDF based on either HMAC using SHA-256 or AES-CMAC as they are easiest to implement and seem to be the most common implementations in the field.

[EDIT] When using HKDF it is advisable use use a Salt value even if your input key material (the master key) provides a lot of entropy. It is however not required for this use case. Neither do you have to use the extract function of HKDF, but normally you would want to perform it anyway for the sake of compatibility. Basically: only skip the Salt and extract function if you have strong resource constraints.

Improve this answer
$\endgroup$
4
  • $\begingroup$ To use HKDF in this example, would you have a unique, randomly-generated salt for each context and perform the entire HKDF-Hash function? Or would you simply use the HKDF-Expand step with the context itself? $\endgroup$
    – Stephen Touset
    Jul 3, 2013 at 17:41
  • 1
    $\begingroup$ Sorry, I may have been unclear. HDKF consists of two steps: HDKF-Expand, and HKDF-Extract. HKDF-Expand expects a salt input. HKDF-Extract expects an info input. For this scenario, would you perform both steps, with a random salt and distinct info per context? Or would you simply perform the HKDF-Extract with the distinct info describing the context? $\endgroup$
    – Stephen Touset
    Jul 3, 2013 at 18:16
  • $\begingroup$ @StephenTouset If there is space for a derived key specific salt I would use it as the authors of HKDF are very clear that using a the Salt provides a lot of security. For an "input key material" with enough entropy the Salt or HKDF-Expand functions are not required, but I would personally always use HKDF-Expand for the sake of compatibility - again as the authors advice in the RFC and paper. Thanks for helping me improve the answer. $\endgroup$
    – Maarten Bodewes ♦
    Jul 4, 2013 at 21:37
  • $\begingroup$ @StephenTouset Removed previous comment, it is better to be cautious regarding security, although adding a salt may be overdoing it for a KBKDF if the master key has enough entropy. $\endgroup$
    – Maarten Bodewes ♦
    Jul 4, 2013 at 21:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.