0

This question already has an answer here:

  1. It is secure to use the shared secret as the key for a HMAC? is it better to derive one key for all of the messages that are going to be HMACed or a key for each message?

  2. Is it safe to use the shared secret as the key for the symmetric encryption after the shared secret has been exchanged using PKI?

Thanks.

marked as duplicate by Steve, Steffen Ullrich, Serge Ballesta, Rory Alsop May 4 '17 at 20:06

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 2
    It's always better not to repeat any key, once used – M.S.P May 3 '17 at 16:12
  • Since you have two questions, I'm not sure if these two are related. Will you encrypt and authenticate/sign (HMAC) each message or just use HMAC on plaintext without encryption? – Marko Vodopija May 3 '17 at 18:03
  • I will encrypt and HMAC each message – Kinikl May 4 '17 at 7:39
0

It is secure to use the shared secret as the key for a HMAC? is it better to derive one key for all of the messages that are going to be HMACed or a key for each message?

As long as you use the key solely for HMAC, you can use single key for multiple messages safely. Many authentication protocols that issue tokens use one key for signing multiple tokens. JWT is one such example. .NET has it's own implementation.

But please note that in case you need to encrypt and then HMAC the message, you need to use two different keys. It is possible to derive these two out of a single, shared master key. See this and this.

There is a better approach though. You can use GCM mode for encryption which will do exactly what you need with a single shared key. Make sure you use it properly, especially concerning the IV. Study it's disadvantages too and see if they concern you.

Is it safe to use the shared secret as the key for the symmetric encryption after the shared secret has been exchanged using PKI?

Yes, this is an approach used in SSL/TLS for example.

Not the answer you're looking for? Browse other questions tagged or ask your own question.