Key derivation procedures and key hierarchies compatible with the mesh link establishment protocol for use in a mesh network. A single cryptographic primitive may be utilized, which is a key derivation function, denoted as kdfK, where K is a cached pairwise master key. The result of the function kdfK may be used to derive the keys used to secure both link establishment and the data subsequently exchanged over the link.