1

I have a 32-byte cryptographic key generated using .NET's cryptographic random number generator, and I'd like to use it as the key material to generate two other keys per user in my web application.

My plan is to use these two derived keys for AES-256-CBC encryption (the first derived key) and HMAC-SHA256 authentication (the second derived key), respectively. The only information I have for deriving the "primary" key is the user identifier, which is a GUID. In other words, for a given user ID, I want to generate on the fly two derived keys for encryption and authentication purposes.

I believe I can use .NET's HKDF.DeriveKey function (with SHA256) for this, but I'm not sure about the values I should provide for the salt and info parameters. Should I use the plain byte representation of the user's ID as the salt and a byte array representing specific context information ('encryption' or 'authentication') as the info parameter?

Prior to posting this question, I tried to understand the NIST's 800-56C Revision 2 paper but I honestly didn't grasp everything. I also tried to read this other NIST SP 800-108r1-upd1 paper but found it confusing.

I also came across this new API in .NET 8, SP800108HmacCounterKdf.DeriveBytes, which also seems to derive keys using a label and context, which made me even more confused. This new API originated from this GitHub issue.

Finally, I tried to search here, but I still wasn't certain of what values to provide, or even which key derivation function to use for my use case.

Anthony Simmon
  • 111
  • 1
  • 1
    You should use HKDF as it's more popular than the NIST KDFs and properly specified rather than having a bunch of options. Specifically, HKDF-Expand because your key is already uniformly random. You only need HKDF-Extract/DeriveKey (which does Extract-then-Expand) when the input keying material isn't uniformly random (e.g., a shared secret from a key exchange). HKDF-Expand doesn't take a salt parameter, and it makes sense for the user's ID to be in the info anyway. – samuel-lucas6 Feb 09 '24 at 08:28
  • 1
    Continuing... You can either run HKDF-Expand once to get a longer output and split it in half for the two keys, or you can run it twice with different info parameters, like 'encryption' and 'authentication' as you suggested. I would probably do the former here. – samuel-lucas6 Feb 09 '24 at 08:30
  • 1
    Does this answer your need? Multiple AES Key Derivation from a master key – kelalaka Feb 09 '24 at 10:07
  • 1
    HKDF (& HKDF-Expand) are both defined in standards as you mention yourself. The parameters are defined in the standards as well. So the question is not .NET specific in any way (which matters on a cryptographic Q/A site like this). – Maarten Bodewes Feb 09 '24 at 11:54

0 Answers0