0

If I ask AWS Key Management Service for a 64-byte key, is it OK to split it in half and use each half as a separate key? e.g. the first half for encryption and the second for HMAC?

I figure that it would be ok because assuming that AWS's keys are high quality, the distribution of information in a key ought to be uniform and the values random. i.e. no byte determines anything about some other byte.

2
  • You would be reducing the encryption key space dramatically, but reducing it from 512 to 256 bits is still leaves a huge key space. Splitting a 128 bit key would drop the key space from very secure to readily crackable. Apr 27 '20 at 17:37
  • If 512 bits were required for each key then I'd request 128 bytes. Apr 27 '20 at 23:28
2

Yes. The documentation for GenerateDataKey says it generates symmetric keys, and those are generally required to be indistinguishable from uniform random data. So for practical purposes, the two halves of the 512-bit key you generate are random and independent from each other, and thus the same as if you'd generated two 256-bit keys separately.

Think of it as equivalent in practice to flipping coins. You want 256 coin flips for an encryption key, and another 256 for a MAC key, and you want to hire Mary to flip coins for you. Do you hire her once to flip 512 coins, or twice to flip 256 coins each time? It doesn't matter...

(The fact that it's symmetric keys is a relevant assumption because if this were, for example, RSA keys or some other variety whose keys aren't just uniform random bits then it'd be a whole different answer.)

1

There is nothing wrong with splitting a key, and using one half for encryption, and the other half for message authentication. See the answer by Thomas Pornin at https://crypto.stackexchange.com/questions/8081/using-the-same-secret-key-for-encryption-and-authentication-in-a-encrypt-then-ma, where he recommends this solution near the end of his answer.

As another example, openssl does key splitting for some of the operations that it performs. See https://crypto.stackexchange.com/questions/3298/is-there-a-standard-for-openssl-interoperable-aes-encryption/79855#79855 as an example, where a key is derived from a password, then half of this key is used for encryption and the other half is used as an IV.

2
  • 1
    The answer linked is about using the same 256-bit key for both AES-256-CBC and HMAC-SHA1. The present question is different; it's about generating 512 bits of key material and using half for a cipher, the other half for a MAC. Apr 27 '20 at 19:39
  • 2
    I'm referring to the sentence near the end of his answer, where he writes, 'This can be as simple as applying SHA-256 on K and splitting the 256-bit result into two 128-bit keys.'.
    – mti2935
    Apr 27 '20 at 20:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.