HKDF Specification (RFC 5869)
HMAC-based Extract-and-Expand Key Derivation Function for deriving keys from shared secrets.
Extract Phase
The extract phase concentrates a potentially weak input keying material into a pseudorandom key of fixed length. It computes a single HMAC using the input material as the message and a salt as the HMAC key. The salt is optional but recommended to bind the derivation to a specific context. The output is a pseudorandom key that hides the structure of the input material from downstream expansion.
- PRK
- Pseudorandom key output of extract
- salt
- Optional random salt, improves domain separation
- IKM
- Input keying material, e.g. DH shared secret
HMAC-Hash(salt, IKM)random bytesg^abExpand Phase
The expand phase derives one or more output keys of arbitrary length from the pseudorandom key. It iterates HMAC, chaining each block into the next, and concatenates the blocks until the desired length is reached. A non-secret info parameter binds each derived key to its intended purpose, preventing key reuse across contexts. The maximum output length is 255 times the hash output size.
Usage Guidelines
HKDF is suitable when the input material is already high-entropy, such as a Diffie-Hellman shared secret. It is not a password-based KDF and must not be used with low-entropy passwords, because it performs no slow stretching. For passwords, use PBKDF2, scrypt, or Argon2 instead. TLS 1.3 uses HKDF extensively as its core key schedule primitive.