- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
closed as unclear what you're asking by e-sushi♦, D.W., DrLecter, figlesquidge, Gilles Mar 31 '14 at 14:43
Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.
It is unclear if you wanted to compare TLS 1.1 PRF or TLS 1.2 PRF. Different TLS versions have different PRFs. Assuming you meant TLS 1.1 PRF although you linked TLS 1.2 RFC.
TLS 1.1 PRF
Short: HKDF is commonly a better choice than TLS 1.1 PRF, but not always.
Consider these aspects:
TLS1.1 PRF has been analyzed in Hash function combiners in TLS and SSL. Based on this analysis, HKDF, when used with a strong hash function is likely stronger than TLS1.1 PRF.
Comparing HKDF with TLS 1.2's PRF.
NIST SP 800-108 Recommendation for Key Derivation Functions defines various ways to construct Key Derivation Function: - Counter Mode - Feedback Mode - Double-Pipeline Iteration Mode
For NIST, all these approaches are equally acceptable. The Feedback Mode matches HKDF's Expand phase. The Double-Pipeline Iteration Mode matches TLS 1.2 PRF. Thus we could assume, that TLS 1.2 PRF could be considered to be similar to HKDF's Expand phase if used with the same hash function underlying the hmac.
Purpose of HKDF's extract phase is quoted from RFC 5869:
For applications where extract phase is beneficial (distribution of input keying material is not uniform), HKDF is certainly the way to go.
For other uses, where expand phase is used alone, any one of these two (or in some cases counter mode) from NIST SP 800-108 could be used. (Note: If you use TLS 1.2 PRF outside context of TLS protocol, maybe better define the function in terms of NIST SP 800-108, instead of TLS 1.2 PRF from the RFC).