Derive a key from public data using a secret master key Users in my system will be given a device that contains a 128-bit AES user key. The user key will be derived from 64 bits of public data related to the user, which is unique but very predictable (i.e. a sequential user ID value). The value of the user key must be kept secret from the users. I assume users are fully aware that the user ID is used in the key derivation and that they know its value. A centrally controlled "master" AES key will be used to derive the user key in each device. Users will have no access to this key.

I've been asked to design the derivation scheme. The goal is to ensure the user has no hope of determining their key based on the 64-bits of public data.

My current plan for this derivation is to concatenate a "context" byte to the user ID and then encrypt it with the master key, using ECB-mode and PKCS&nbsp;#7 padding and use the result as the user key.

Does this simplistic derivation scheme meet my design goal? Without knowledge of the master key, I can't fathom how users could infer anything about the user key from the public data. However the simplicity of my design worries me.

I have encountered key derivation schemes, such as RFC 5869 that might be appropriate. I would be much happier using a peer-reviewed method rather than designing my own if someone can point at a suitable standard.
I'd still go with HKDF. Since you already have a good uniform master key, you can skip the extraction step.

So HKDF simply becomes HMAC-SHA-2(masterKey, info+\x01) I'd start info with a string identifying your use, and add the user specific information after that.

Your system should be secure as well as long as you only produce a single block of output. Essentially the user specific info serves as an IV for a mode similar to AES-CTR.

NIST Special Publication 800-56C - Recommendation for Key Derivation through Extraction-then-Expansion defines a scheme similar to AES, but it's probably unnecessarily complicated for your scenario.