HKDF

HKDF is the composition of two functions, HKDF-Extract and HKDF-Expand: HKDF ⁡ ( s a l t , I K M , i n f o , L ) = H K D F - E x p a n d ( H K D F - E x t r a c t ⁡ ( s a l t , I K M ) , i n f o , L ) {\displaystyle \operatorname {HKDF} ({\mathit {salt}},{\mathit {IKM}},{\mathit {info}},L)=\operatorname {HKDF{-}Expand} \!\left(\operatorname {HKDF{-}Extract} ({\mathit {salt}},{\mathit {IKM}}),{\mathit {info}},L\right)} HKDF-Extract ( X T R {\displaystyle \mathrm {XTR} } ) takes "input key material" or "source key material" ( I K M {\displaystyle \mathrm {IKM} } or S K M {\displaystyle \mathrm {SKM} } ) such as a shared secret generated using Diffie-Hellman; an optional, non-secret, random or pseudorandom salt ( r {\displaystyle r} ); and generates a cryptographic key called the P R K {\displaystyle \mathrm {PRK} } ("pseudorandom key"). HKDF-Extract acts as a "randomness extractor", specifically a "computational extractor", taking a potentially non-uniform value of sufficient min-entropy and generating a value indistinguishable from a uniform random value (pseudorandom). Computational extractors assume attackers are computationally bounded and source entropy may only exist in a computational sense. Such extractors can be built using cryptographic functions under suitable assumptions, modeled as universal hash function (in the generic case) or a random oracle (in constrained scenarios like sources with weak entropy). Salt ( r {\displaystyle r} ) acts as a "source-independent extractor", strengthening HKDF's security guarantees. Using a fixed public r {\displaystyle r} is safe for multiple invocations of HKDF (on "independent" but secret IKMs which may or may not be derived from the same source), provided r {\displaystyle r} isn't chosen or manipulated by an attacker. Ideally, r {\displaystyle r} is a random string of hash function's output length. Even low quality r {\displaystyle r} (weak entropy or shorter length) is recommended as they contribute "significantly" to the security of the O K M {\displaystyle \mathrm {OKM} } .