{c}

\b[HKDF] is an <HMAC>-based <key derivation function> with extraction and expansion stages. Extraction combines initial material $\mathrm{IKM}$ with a <cryptographic salt> to produce an intermediate key $\mathrm{PRK}$. Expansion uses that key, context `info` and an output length $L$. RFC 5869 specifies the construction as an Informational RFC.<HMAC-based Extract-and-Expand Key Derivation Function (HKDF) by Hugo Krawczyk and Pasi Eronen>[Status of This Memo; §§2.2–2.3]{ref}

Writing $\Vert$ for <concatenation>, its equations are
$$
\mathrm{PRK}=\operatorname{HMAC}(\mathrm{salt},\mathrm{IKM}),\qquad T_0=\epsilon,
$$
$$
T_i=\operatorname{HMAC}(\mathrm{PRK},T_{i-1}\Vert\mathrm{info}\Vert\mathrm{byte}(i)).
$$
The output is the first $L$ bytes of $T_1\Vert\cdots\Vert T_N$, where $N=\lceil L/h\rceil$ and $h$ is the digest length in bytes. The counter occupies one byte, giving $L\leq255h$. The first HMAC argument is the key; swapping its two arguments changes the construction.<HMAC-based Extract-and-Expand Key Derivation Function (HKDF) by Hugo Krawczyk and Pasi Eronen>[§2.1, HMAC argument convention; §§2.2–2.3, extraction and expansion]{ref}

For <SHA-256>, $h=32$. Requesting $L=42$ therefore requires two expansion blocks, using all 32 bytes of the first and ten of the second. The maximum specified length is $255\times32=8160$ bytes. Requesting a longer output under that one-byte counter rule is not an additional iteration of the same specification.

RFC 5869 Appendix A.1 supplies a reproducible example: 22 input bytes each equal to hexadecimal `0b`, salt bytes `00` through `0c`, and `info` bytes `f0` through `f9`, with $L=42$. The resulting output, written as <hexadecimal>, is

`3cb25f25faacd57a90434f64d0362f2a2d2d0a90cf1a5a4c5db02d56ecc4c5bf34007208d5b887185865`.

That is 84 hexadecimal digits representing 42 bytes. Each expansion block depends on its predecessor as well as the context and counter; independently hashing the counter would describe a different function.<HMAC-based Extract-and-Expand Key Derivation Function (HKDF) by Hugo Krawczyk and Pasi Eronen>[Appendix A.1, Test Case 1]{ref}

A salt need not be secret, while the derived key material must receive the protection required by its role. Context can distinguish protocol uses through <cryptographic domain separation>. Neither changing a label nor asking for more bytes supplies additional secret entropy to a weak input.


 HKDF (source code)