HKDF is an HMAC-based key derivation function with extraction and expansion stages. Extraction combines initial material with a cryptographic salt to produce an intermediate key . Expansion uses that key, context
info and an output length . RFC 5869 specifies the construction as an Informational RFC.[ref]HMAC-based Extract-and-Expand Key Derivation Function (HKDF) by Hugo Krawczyk and Pasi Eronen. Status of This Memo; §§2.2–2.3
Writing for concatenation, its equations areThe output is the first bytes of , where and is the digest length in bytes. The counter occupies one byte, giving . The first HMAC argument is the key; swapping its two arguments changes the construction.[ref]
HMAC-based Extract-and-Expand Key Derivation Function (HKDF) by Hugo Krawczyk and Pasi Eronen. §2.1, HMAC argument convention; §§2.2–2.3, extraction and expansion
For SHA-256, . Requesting therefore requires two expansion blocks, using all 32 bytes of the first and ten of the second. The maximum specified length is bytes. Requesting a longer output under that one-byte counter rule is not an additional iteration of the same specification.
RFC 5869 Appendix A.1 supplies a reproducible example: 22 input bytes each equal to hexadecimal
0b, salt bytes 00 through 0c, and info bytes f0 through f9, with . The resulting output, written as hexadecimal, is3cb25f25faacd57a90434f64d0362f2a2d2d0a90cf1a5a4c5db02d56ecc4c5bf34007208d5b887185865.That is 84 hexadecimal digits representing 42 bytes. Each expansion block depends on its predecessor as well as the context and counter; independently hashing the counter would describe a different function.[ref]
A salt need not be secret, while the derived key material must receive the protection required by its role. Context can distinguish protocol uses through cryptographic domain separation. Neither changing a label nor asking for more bytes supplies additional secret entropy to a weak input.
Articles by others on the same topic
HKDF, or HMAC-based Key Derivation Function, is a key derivation function that is based on HMAC (Hash-based Message Authentication Code). It is designed to be used to derive cryptographic keys or pseudorandom keys from a given input keying material. HKDF is defined in RFC 5869 and is notable for its robustness and simplicity.