Skip to main content
Commerce Security Authority
Category: Key Management

NIST SP 800-108

Also known as: SP 800-108, SP 800-108 Rev. 1, SP 800-108r1, NIST SP 800-108r1-upd1, Recommendation for Key Derivation Using Pseudorandom Functions
Simply put

NIST SP 800-108 is a U.S. National Institute of Standards and Technology recommendation that describes approved methods for creating additional cryptographic keys from an existing secret key. Rather than generating each key independently, these techniques let a system derive further keying material from a key that was already established. This helps organizations produce the keys they need in a consistent, standardized way.

Formal definition

NIST SP 800-108 specifies techniques for the derivation of additional keying material from a secret key-derivation key, which may itself have been established through a key-establishment scheme or otherwise generated. The recommendation defines key-derivation functions (KDFs) built on pseudorandom functions (PRFs), and Revision 1 (SP 800-108r1, published August 2022, with an update SP 800-108r1-upd1) supersedes the original 2009/2008 publication and revises notation and guidance. It governs KDF construction and approved PRFs; it does not itself perform key establishment, key transport, or key agreement, and practitioners should confirm supported PRFs, parameters, and approved modes against the current published version of the standard.

Why it matters

Cryptographic systems frequently need more keying material than a single established secret can directly provide. NIST SP 800-108 gives organizations a standardized, vetted way to derive additional keys from an existing secret key-derivation key, rather than improvising ad hoc derivation logic that may be weak or inconsistent. In payment security contexts, where cryptographic keys protect cardholder data and secure sensitive operations, using an approved key-derivation function helps ensure that derived keys are produced in a manner that has been formally analyzed and is recognized as approved by NIST.

Because SP 800-108 is a recommendation focused specifically on key derivation using pseudorandom functions, it occupies a defined slot in a larger key-management picture. It does not perform key establishment, key transport, or key agreement; those functions are addressed by other schemes and standards. Treating SP 800-108 as a complete key-management solution would be a mistake. Its value is that it standardizes one well-scoped step, deriving further keys from a key that was already established or generated, so that step is not left to individual implementers to design.

Versioning matters for anyone building against this standard. Revision 1 (SP 800-108r1, published August 2022, with the update SP 800-108r1-upd1) supersedes the original 2008/2009 publication and revises notation and guidance. Practitioners should confirm supported pseudorandom functions, parameters, and approved modes against the current published version rather than relying on older documentation, since the details that govern a compliant implementation can differ between revisions.

Who it's relevant to

Cryptographic engineers and key-management architects
Teams designing how keys are generated and derived within a system use SP 800-108 to produce additional keying material from an established key in an approved, standardized manner. They should pair it with the separate schemes that handle key establishment, transport, and agreement, since SP 800-108 does not cover those functions, and confirm supported PRFs and modes against the current revision.
Compliance officers and validators
Those assessing whether cryptographic controls rely on approved methods can reference SP 800-108 as the recommendation governing key-derivation functions built on pseudorandom functions. They should verify which revision (the 2008/2009 original versus SP 800-108r1 / SP 800-108r1-upd1) an implementation targets, because notation and guidance were revised in Revision 1.
Payment system and product security teams
Engineers building systems that protect cardholder data with cryptographic keys may derive working keys from an established key-derivation key using an approved KDF. They should treat SP 800-108 as one well-scoped step in a broader key-management program and confirm approved parameters against the current published standard.

Inside NIST SP 800-108

Key Derivation Function (KDF)
NIST SP 800-108 specifies methods for deriving one or more additional cryptographic keys from an existing secret key, referred to as the key derivation key. It addresses derivation from an already-established key rather than from low-entropy passwords, which are covered by separate guidance.
Key Derivation Key
The input keying material to the KDF. This is a pre-existing cryptographic key of adequate strength, distinguishing SP 800-108 from password-based derivation guidance where the input is a low-entropy secret.
PRF-based construction modes
The standard defines constructions built on an approved pseudorandom function, commonly a keyed-hash MAC or a block-cipher-based MAC. These modes describe how the PRF is iterated to produce derived keying material.
Counter, Feedback, and Double-Pipeline modes
SP 800-108 describes distinct iteration modes that determine how successive PRF invocations are chained and how a counter or prior output feeds into the next block of derived output.
Context and label inputs
The KDF incorporates context-binding inputs such as a label and context string so that derived keys are cryptographically tied to their intended use, helping ensure distinct keys are produced for distinct purposes.
Relationship to payment key management
In payment environments, derivation of working keys from base keys is governed by requirements in the PCI PIN standard and related network and HSM specifications. SP 800-108 is a NIST cryptographic reference and is separate from PCI DSS itself; confirm which standard governs a given control in your environment.

Common questions

Answers to the questions practitioners most commonly ask about NIST SP 800-108.

Is NIST SP 800-108 a PCI standard, or does it satisfy PCI DSS key management requirements on its own?
No. NIST SP 800-108 is a publication from the National Institute of Standards and Technology that specifies methods for key derivation using pseudorandom functions; it is not a PCI Security Standards Council standard such as PCI DSS, PCI P2PE, or PCI PIN. Referencing or using an SP 800-108 key derivation function does not by itself satisfy PCI DSS key management requirements. PCI DSS addresses key management through its own requirements, and cryptographic controls for specific use cases may fall under other standards such as PCI PIN or PCI P2PE. You should confirm applicable key management obligations against the current published version of the relevant PCI standard rather than assuming that adopting SP 800-108 achieves compliance.
Does a key derivation function under SP 800-108 encrypt or protect cardholder data the way encryption or tokenization does?
No. SP 800-108 defines key derivation functions, which take an existing key and produce one or more additional keys. It is not itself a data protection mechanism for cardholder data. Encryption transforms data using a key so it can be recovered with the corresponding key, tokenization substitutes a surrogate value, and truncation, masking, and hashing transform or reduce data in other ways. A key derivation function operates on keys, not directly on the PAN or other cardholder data, and its role is to produce keying material that other cryptographic processes then use. The effect of any of these on PCI DSS scope depends on implementation and validation, not on the label.
How does key derivation under SP 800-108 differ from key generation?
Key generation typically produces a key from a source of randomness, while key derivation under SP 800-108 takes an existing input key, referred to as key derivation key material, and applies a pseudorandom function to produce derived keys. This lets one high-value key produce multiple working keys without generating each independently from a random source. When you design a cryptographic architecture, you should be clear about which keys are generated versus derived, since that distinction affects how each key must be managed, protected, and rotated.
What inputs does an SP 800-108 key derivation function require, and why do they matter?
An SP 800-108 key derivation function uses a key derivation key together with context and label information supplied to the underlying pseudorandom function. The context and label inputs help ensure that derived keys are distinct and bound to their intended use, so that the same input key does not produce colliding or reused keys across different purposes. When implementing, define these inputs carefully and document how each derived key is intended to be used, since ambiguous or reused context values can undermine the separation the derivation is meant to provide.
How should the key derivation key itself be protected in an implementation?
Because derived keys depend on the key derivation key, that input key generally warrants strong protection appropriate to its role. In payment environments, cryptographic key protection may involve hardware security modules and controls governed by standards such as PCI PIN or PCI P2PE, depending on the use case, in addition to any applicable PCI DSS key management requirements. You should identify which standard governs your specific scenario and validate protection of the derivation key against the current published requirements rather than treating the derivation function alone as sufficient.
Where does SP 800-108 fit relative to other cryptographic controls in a payment security design?
SP 800-108 addresses one part of a cryptographic architecture, the derivation of keys from existing keying material, and is intended to support rather than replace other controls. It does not perform authentication, and it is separate from transaction-level controls such as EMV chip authentication, 3-D Secure, or multi-factor authentication, which address different risks at different points. When documenting your design, place key derivation within the broader set of generation, distribution, storage, use, rotation, and retirement processes, and confirm each control against the standard that actually governs it.

Common misconceptions

NIST SP 800-108 can be used to derive keys directly from user passwords or PINs.
SP 800-108 is intended for derivation from an existing high-entropy key derivation key, not from low-entropy secrets such as passwords. Password-based derivation is addressed by separate NIST guidance, and this distinction matters because using a low-entropy input with an SP 800-108 KDF does not add the stretching intended for weak secrets.
Following SP 800-108 satisfies PCI DSS key management requirements by itself.
SP 800-108 is a cryptographic construction reference and does not, on its own, establish compliance. Payment key management obligations may be governed by PCI DSS and, for PIN-related keys, by the separate PCI PIN standard; requirement wording and numbering differ between versions, so confirm against the current published standards.
The different modes (counter, feedback, double-pipeline) are interchangeable and produce identical results.
The modes are distinct constructions with different chaining behavior, and they are not required to yield equivalent output for the same inputs. The choice of mode, PRF, and context inputs must be specified and validated rather than assumed from the label alone.

Best practices

Use SP 800-108 KDFs only with an adequately strong key derivation key, and route low-entropy secrets such as passwords through the appropriate password-based derivation guidance instead.
Bind each derived key to its intended purpose using distinct label and context inputs so that keys used for different functions are cryptographically separated.
Select an approved PRF and derivation mode explicitly, document the choice, and validate the implementation rather than relying on the KDF label to imply correctness.
For payment PIN and working-key derivation, confirm the governing requirements in the PCI PIN standard and applicable network and HSM specifications, and verify against the current published versions rather than assuming fixed requirement numbers.
Treat SP 800-108 as one component of key management and pair it with controls for key generation, storage, rotation, and destruction defined by the applicable standards.
Where derived keys protect cardholder data, keep derivation practices consistent with the current PCI DSS requirements and confirm scope and wording against the published standard for your environment.