Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Assume for the sake of the question that I have two variable-length bit strings, each with 128 bit cryptographic randomness, and I want to extract two 128 bit keys via HKDF-SHA256.

Which alternative is better (if any), and why?

  1. Use a single HKDF-extract on the concatenation of the two strings, and two HKDF-expands with different info strings to get two 128 bit keys.
  2. Use two HKDF-extract operations, one for each bit string, and use a single HKDF-expand on each to get two 128 bit keys.

Or in other words, is it better to HKDF-extract on a longer IKM string and use multiple HKDF-expands, or is it better to use HKDF on independent but shorter IKMs.

My intuition tells me that, if my randomness strings are really as good as I claim, then two independent HKDF extracts are better, but using a single one on the concatenation is, in practice, just as safe, and safer if my input randomness is not actually as good as assumed, so two HKDFs might be more robust in practice.

share|improve this question
there's also a third option: similar to the first option, but expand once and request 256 bits of output, and split the output to make two keys –  hunter Jul 19 '13 at 12:14
The HKDF RFC stresses that different keys should use different info strings, so while that option exists, it's probably a weaker variant of a). –  Marc Lehmann Jul 19 '13 at 13:03
thanks for the heads-up... I didn't know that. –  hunter Jul 19 '13 at 18:58
@MarcLehmann I deleted my answer because you said that your bitstrings contain 128 bit randomness. In that case a KDF is appropriate and should be used, You confused me however by saying that your bitstrings are 128 bit cryptographic randomness, which in my book would mean that an attacker can not accurately predict the next bit of randomness given all previous bits in less than $2^{128}$ time. –  nightcracker Jul 19 '13 at 19:26
I never said they are 128 bit randomness, I explicitly wrote the strings are variable-length. Also, your answer was wrong even if your assumption would have been true: Your claim that the purpose of KDFs is to expand small keyspaces and increase brute force costs linearly is simply wrong. It's correct for PBKDFs, though, as I remarked to you. –  Marc Lehmann Jul 19 '13 at 19:43
show 3 more comments

1 Answer

Realistically, it probably doesn't matter, if all of your premises are accurate.

If it were me, I'd probably concatenate the inputs, then apply a HKDF to the concatenation to derive two keys -- but honestly, it's unlikely to matter. This is very unlikely to be the weakest link in your system. Pick something that's easy to implement and easy to understand, and move on: focus your energy on some other aspect of your system.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.