= Pasi Eronen
{c}
<Pasi Eronen> is a <computer scientist> contributing to Internet security and <cryptographic protocols>. His IETF author record links a series of protocol specifications; RFC 5869's author-contact section gives his full name and a Nokia Research Center affiliation at publication.<Pasi Eronen profile in the IETF Datatracker>[Named author record.]{ref}<HMAC-based Extract-and-Expand Key Derivation Function (HKDF) by Hugo Krawczyk and Pasi Eronen>[May 2010, Authors’ Addresses.]{ref}
With <Hugo Krawczyk>, <Pasi Eronen> specified <HKDF>, an <HMAC>-based <key derivation function>. It separates extraction of an intermediate pseudorandom key from expansion into output keying material, with <cryptographic salt> and application context supplied as specified inputs.<HMAC-based Extract-and-Expand Key Derivation Function (HKDF) by Hugo Krawczyk and Pasi Eronen>[§§2.1–2.3, construction and argument order.]{ref}
An original output-length calculation illustrates the design. With <SHA-256>, each expansion block has 32 <bytes>. Requesting 42 <bytes> therefore requires two blocks: all 32 <bytes> of the first and the first 10 of the second. The one-byte block counter limits expansion to 255 blocks, hence 8160 <bytes> for this hash. These are construction limits, not claims that a longer output contains more independent secret information than its input.<HMAC-based Extract-and-Expand Key Derivation Function (HKDF) by Hugo Krawczyk and Pasi Eronen>[§2.3, expansion, counter and length bound.]{ref}
The context input supports <cryptographic domain separation>. A protocol can distinguish two intended roles by unambiguous labels rather than silently reuse identical derived material. The surrounding <cryptographic protocol> must still authenticate its parties and provide suitable input secrets; <HKDF> does not establish those properties by itself.<HMAC-based Extract-and-Expand Key Derivation Function (HKDF) by Hugo Krawczyk and Pasi Eronen>[§3.2, context binding.]{ref}
\Image[https://www.ietf.org/lib/dt/media/photo/pasi-eronen-y7nVV-th.jpg]
{title=<Pasi Eronen>, portrait identified by his IETF Datatracker profile}
Back to article page
