cryptographykeyhmaccbc-mac

Using one key for Encryption and HMAC

I am wondering whether I can use a shared secret key established between two clients as the HMAC key too.

I saw that there is a problem when it is used as a CBC-MAC but I haven't found any evidence it is bad practice for HMACs.

Thanks, Vladimir

Solution

  • I believe it is currently in the category of "seems probably OK, but why take the risk?".

    Best practice is to have each side generate two new keys from the shared secret key:

    encryption-key := HMAC(shared-key, "Encryption Nonce")
hmac-key := HMAC(shared-key, "Authenticity Nonce")