= Cryptographic domain separation
\b[Cryptographic domain separation] distinguishes intended uses of cryptographic computations by encoding their roles or contexts into the inputs. A <key derivation function> can thereby derive different role-specific <cryptographic keys> from shared initial material. For <HKDF>, the `info` field is specifically intended to bind the output to application context, including relevant protocol and algorithm information.<HMAC-based Extract-and-Expand Key Derivation Function (HKDF) by Hugo Krawczyk and Pasi Eronen>[§3.2, the info input]{ref}
For an original computed example, use the extraction result from RFC 5869 Test Case 1, then expand it to sixteen bytes with the ASCII context `app/send`. The result is
`e2f1c135562168a517b5c5451fd68f76`.
Keeping the same intermediate key and length but changing context to `app/recv` gives
`c5302399f25698fce7c4e33ad0c8b479`.
These are new computations using the specified <HKDF> expansion; the contexts are illustrative application labels, not additional published test vectors. Repeating exactly the first set of inputs reproduces exactly its first output. The distinction is encoded in the context rather than obtained by hoping repeated deterministic calls will differ.
The encoding must preserve the intended distinction. Raw <concatenation> sends both field pairs `ab`, `c` and `a`, `bc` to `abc`. A <length-prefixed encoding> with one-byte lengths instead gives `02 61 62 01 63` and `01 61 02 62 63`. These five-byte strings differ, even though their unstructured character concatenations agree. The one-byte example assumes each field is shorter than 256 bytes; a protocol must define its full length limits and encoding.
Different encodings do not mathematically guarantee different finite-length digests: distinct inputs can still collide. Domain separation supplies a structured distinction on which the construction's security argument can rely. It also does not authenticate a context string supplied by an attacker. The surrounding <cryptographic protocol> must establish the identities and agreed roles whose labels it encodes.
Salt and context have different jobs in <HKDF>. The <cryptographic salt> is an extraction input, while `info` is an expansion input. Reusing one parameter as if it automatically established every other required binding changes the specified construction.
Back to article page
