AES vs AES-CMAC for session key derivation Assume two parties have exchanged a secret 128-bit Master Key, MK.
When the two parties want to communicate, one of them generates a random 128-bit value, R, which is then sent in plaintext to the other party. Then, a KDF is used to generate a 128-bit Session Key, SK.

SK = KDF(MK, R)


SK is then used to encrypt communication between the parties. Let's say an authenticated encryption algorithm as AES-CCM is used with SK as input.

The question is: is there any difference between choosing a simple AES primitive and the more complex AES-CMAC as KDF?
The question is: is there any difference between choosing a simple AES primitive and the more complex AES-CMAC as KDF?


If you use AES as "KDF" in this way, it is equivalent to sending an AES-ECB encrypted key that the recipient decrypts. It's just that you have swapped the direction of encryption and decryption for AES. (AES-ECB is secure with random one-block messages.)

Using CMAC is slower if you take into account the key derivation, but not much different otherwise.

Note that neither version of the protocol has any protection against replay attacks. An attacker can send an R value that has already been used and make the other party reuse a key. Depending on what that session key is actually used for, that can be really bad. (E.g. CTR mode with constant starting nonce.)

A proper protocol would likely let both parties affect the session key. Using e.g. ephemeral Diffie–Hellman with the master key for authentication would be one way to accomplish that while also getting forward secrecy.