DataTerminology.comNEW
Also known as: HMAC-based Extract-and-Expand Key Derivation Function
An HMAC-based key derivation function that extracts entropy and expands it into strong cryptographic keys.
DESCRIPTION
HKDF is a two-stage key derivation function that uses HMAC to first extract randomness from input keying material and then expand it into one or more cryptographic keys. It is simple, provably sound under standard assumptions, and widely used in modern protocols such as TLS 1.3 and Noise. HKDF supports context binding via salt and info parameters to prevent key reuse across domains. It is favored for its robustness, modularity, and resistance to poor entropy mixing compared to ad hoc constructions.
ALTERNATIVE DEFINITIONS
IETF RFC 5869
This document specifies a simple HMAC-based key derivation function (HKDF), which can be used as a building block in various protocols and applications.
Emphasizes simplicity, HMAC foundation, and use as a general-purpose building block.
Wikipedia
HMAC-based key derivation function (HKDF) is a key derivation function based on HMAC and standardized in RFC 5869.
Highlights the standardization in RFC 5869 and the HMAC basis.
RELATED TERMS
HMAC Key Derivation Function Salt Key Stretching TLS 1.3 Nonce Entropy
COMPETING TERMS
Password-Based Key Derivation Function 2 scrypt Argon2
KNOWLEDGE AREAS
Data Security Software Engineering Mathematics Infrastructure
TARGET AUDIENCE
Security Architect Cybersecurity Engineer Software Developer Cloud Architect Chief Information Security Officer DevOps Engineer
EXTERNAL SOURCES
- Wikipedia - HKDF
- IETF - Official HKDF specification.
- IETF - TLS 1.3 uses HKDF key schedule.
- NIST - HMAC-based KDF methods and guidance.
- OpenSSL - HKDF usage in OpenSSL API.
TOP QUESTIONS
What problem does HKDF solve?
HKDF standardizes extracting and expanding cryptographic keys from potentially weak or biased input material. It avoids ad hoc constructions that may fail under subtle entropy or context issues.
Category: Overview
How does HKDF differ from PBKDF2, scrypt, or Argon2?
HKDF is not memory-hard and is designed for key separation and context binding, not password hashing. PBKDF2, scrypt, and Argon2 are password KDFs designed to slow brute-force attacks.
Category: Comparison
When should HKDF be used in TLS 1.3?
HKDF underpins the TLS 1.3 key schedule, deriving handshake and application keys. Implementers typically rely on library-provided HKDF rather than coding it themselves.
Category: Application
Why is the salt important in HKDF?
Salt adds randomness and context to the extraction phase, improving security when input keying material has limited entropy. It also helps prevent key reuse across different domains.
Category: Best practices
What are common mistakes when using HKDF?
Reusing salts or info across unrelated contexts, skipping the extract phase, or deriving too many bytes without proper counters can weaken separation. Always use well-tested library functions.
Category: Mistakes
Is HKDF suitable for password hashing?
No. HKDF lacks memory-hardness and is fast by design. Use Argon2, scrypt, or PBKDF2 for password hashing to resist brute-force attacks.
Category: Misunderstanding
How does the info parameter in HKDF improve security?
The info parameter binds derived keys to specific contexts or protocols, preventing key material from being valid across different uses and reducing risks of key misuse.
Category: Concept
How long can HKDF outputs be?
HKDF outputs can be as long as needed up to the maximum specified in the RFC, by iterating expand blocks. However, derive only what is necessary for your protocol.
Category: Limits
What is a practical starting point to learn HKDF?
Read RFC 5869 for the specification and examine a reference implementation in OpenSSL or libsodium. Test vectors in the RFC help validate correctness.
Category: Learning