Pre-Draft Call for Comments: Recommendation for Key Derivation Using Pseudorandom Functions

Date Published: November 4, 2026
Comments Due: December 18, 2026
Email Comments to: [email protected]

Author(s)

National Institute of Standards and Technology

Announcement

NIST plans to revise NIST Special Publication (SP) 800-108r1 (Revision 1), Recommendation for Key Derivation Using Pseudorandom Functions, and invites public comments on the proposed revision.

SP 800-108 specifies methods for constructing key-derivation functions (KDFs) based on pseudorandom functions (PRFs), including CMAC, HMAC, and KMAC. For PRFs with fixed-length outputs, the publication specifies three iterative modes: Counter Mode (CTR), Feedback Mode (FB), and Double-Pipeline Iteration Mode (DP). Revision 1 also introduced strengthened CMAC-based constructions to mitigate key-control attacks.

Motivation for Revision

Recent research has identified security and design issues that affect some constructions specified in SP 800-108:

• Indistinguishability. SP 800-108 defines the security strength of a KDF in terms of the work required to distinguish its output from a uniformly distributed bit string of the same length. Recent work (ePrint 2025/1586) demonstrates practical distinguishers against CMAC-FB and HMAC-FB constructions under certain permitted choices of the initialization vector. These results raise questions about whether the current specifications of these constructions adequately satisfy the stated criterion of indistinguishability.
• Key-Control Security. Key-control attacks assume a scenario in which a party that knows the key-derivation key maliciously selects KDF inputs to influence or control the derived key. Practical attacks have been demonstrated against CMAC-CTR and CMAC-FB (Comment by Amazon). Subsequent work (ePrint 2025/1123) has formalized key-control security and established security results for several KDF constructions. These developments motivate consideration of whether key-control security should be addressed explicitly in SP 800-108.
• Continued Relevance of Double-Pipeline Iteration Mode. DP was included in SP 800-108 in part because of its relationship to the KDF used in TLS 1.2. However, that KDF was not retained in TLS 1.3, which reduces the interoperability rationale for maintaining DP. In addition, current analyses indicate that DP and the strengthened CMAC-based DP construction may provide similar security properties. Therefore, NIST is considering whether both constructions should remain in the publication.

Potential Scope of Revision 2

NIST is considering the following updates:

• Clarify the security properties expected of KDF constructions, including indistinguishability and key-control security
• Revise constructions that are affected by distinguishability and key-control security
• Consider guidelines on the use of CMAC-based constructions
• Reconsider whether both DP constructions should remain in the publication
• Make additional editorial, technical, and organizational improvements.

Questions for Public Comment

1. How should SP 800-108 address the distinguishability results for CMAC-FB and HMAC-FB? For example, should the publication require a fixed IV, require the IV to be derived from the context, make use of a counter mandatory, or impose another structural requirement?
2. How should SP 800-108 address key-control security? In particular, should key-control security be treated as a generally expected property of an approved KDF or as an application-dependent property?
3. Should both the Double-Pipeline Iteration Mode and the strengthened CMAC-based DP construction introduced in Revision 1 remain in SP 800-108? Are there significant implementation, interoperability, security, or deployment considerations that justify retaining either or both constructions?
4. What compatibility or transition issues should NIST consider when revising, deprecating, or removing existing constructions?
5. Are there other technical, security, usability, validation, or interoperability issues that should be addressed in the revision?

Request for Comments

NIST invites comments from the cryptographic research community, implementers, industry practitioners, and other interested stakeholders on the issues described above as well as any additional considerations relevant to the revision of SP 800-108.

The public comment period is open through December 18, 2026.

Send comments to [email protected] with "Comments on SP 800-108" in the subject line.

Control Families

None selected