# multiple keys via HKDF - whats better, one or two applications of HKDF-extract

Assume for the sake of the question that I have two variable-length bit strings, each with 128 bit cryptographic randomness, and I want to extract two 128 bit keys via HKDF-SHA256.

Which alternative is better (if any), and why?

1. Use a single HKDF-extract on the concatenation of the two strings, and two HKDF-expands with different info strings to get two 128 bit keys.
2. Use two HKDF-extract operations, one for each bit string, and use a single HKDF-expand on each to get two 128 bit keys.

Or in other words, is it better to HKDF-extract on a longer IKM string and use multiple HKDF-expands, or is it better to use HKDF on independent but shorter IKMs.

My intuition tells me that, if my randomness strings are really as good as I claim, then two independent HKDF extracts are better, but using a single one on the concatenation is, in practice, just as safe, and safer if my input randomness is not actually as good as assumed, so two HKDFs might be more robust in practice.

-
there's also a third option: similar to the first option, but expand once and request 256 bits of output, and split the output to make two keys – hunter Jul 19 '13 at 12:14
The HKDF RFC stresses that different keys should use different info strings, so while that option exists, it's probably a weaker variant of a). – Marc Lehmann Jul 19 '13 at 13:03
thanks for the heads-up... I didn't know that. – hunter Jul 19 '13 at 18:58
@MarcLehmann I deleted my answer because you said that your bitstrings contain 128 bit randomness. In that case a KDF is appropriate and should be used, You confused me however by saying that your bitstrings are 128 bit cryptographic randomness, which in my book would mean that an attacker can not accurately predict the next bit of randomness given all previous bits in less than $2^{128}$ time. – orlp Jul 19 '13 at 19:26
I never said they are 128 bit randomness, I explicitly wrote the strings are variable-length. Also, your answer was wrong even if your assumption would have been true: Your claim that the purpose of KDFs is to expand small keyspaces and increase brute force costs linearly is simply wrong. It's correct for PBKDFs, though, as I remarked to you. – Marc Lehmann Jul 19 '13 at 19:43