I want to use a key derivation function to derive a key to another one.

I think HKDF is the easiest solution in my case.

The following picture gives a clear definition of it : http://webee.technion.ac.il/~hugo/kdf/hkdf-fig.jpg

In the case where the number of key bits request from the KDF is equal to the hash output length (i.e. L = k in the definition) do I have to compute 2 HMAC :

PRK = HMAC(XTS, SKM) and K(1) = HMAC(PRK, CTXinfo)

or can I directly compute :

K(1) = HMAC(SKM, CTXinfo) ?

Thank you in advance.


HKDF stage 1 is useful for when the SKM value is derived using some deterministic method, such as a key exchange, or from a source that may not be fully trusted. SKM may be substantially larger than the keys you want, but may have the entropy not evenly distributed. Stage 1 compacts and distributes the entropy into a key that is correctly sized for the hash function in stage 2.

If you have a source key from a true random number generator, or that has already gone through a strong KDF, you can substitute PRK with SKM, and skip the first HMAC operation.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.