Should I use independent symmetric keys for each client should I use keys derived from a master key? I have several clients that I communicate with from a central location. All connections are encrypted using static symmetric keys that are hard-coded in each client config file. I use a different key for each client because it is possible that someone gains access to the key of a client. In that case I want the attacker to be unable to access connections established by other clients.

Until now I was creating client keys manually by typing characters at random on my keyboard. I thought creating keys manually is not a good idea because in addition to being tedious it is error prone and somewhat insecure. So just now I was writing a key generator program that creates random keys for me.

But in the meanwhile another idea hit my brain: I can have just one master key and derive all client keys from it! For example suppose my master key is '123456', I can derive the first client key like this:

SHA256('123456'|'client1')


Is that OK?

Is it better to continue writing my key generator program and use separate and completely independent keys for each client or is deriving all keys from a master key acceptable?

Whatever approach I use, I need all client keys at a central controller  location, so if an attacker gains access to this central location he has all the keys anyway, thus seems there is no advantage to using independent random keys for me.

P.S.: My master key is not something like '123456'; It is really/sufficiently strong!
Yeah, sure, you can derive keys from a master key. This is often performed for schemes using symmetric encryption primitives. And yes, including the ID of the client is generally the way to do this.

SHA-256 is not a brilliantly secure KDF - but in general it will do. You'd better use a real Key Based Key Derivation Function though. Currently HKDF is all the rage, which uses HMAC underneath. HMAC in turn can be configured using a secure hash such as SHA-256. 

When starting from a secure master key you can directly use HKDF-expand (skipping HKDF-extract) where available.



Note that transport security requires extra care. In general you may want to bold on perfect forward secrecy (ephemeral Diffie-Hellman) or other key derivation techniques that create session keys from your client keys. You may also need a form of authenticated encryption using HMAC or an authenticated cipher such as AES-GCM.