# What are the typical input lengths for KDFs?

I am looking for typical input lengths for key derivation functions like the HKDF. I know the parameters of HKDF, but can not find any information about typical input sizes to HKDF or any of the other KDFs. What are the typical input lengths for KDFs? If possible, can you also point me to (a) relevant reference paper(s)?

• Why would there be a typical inputlength? Isn't it just you give as much entropy as you need your results to have? – axapaxa Oct 27 '16 at 16:46
• The situation is, I am writing about key derivation systems my bachelors thesis. Part of that is a benchmark. I am testing different inputsizes for example. But in practice nobody uses for example inputs with a size of 1 MB. So I would like to find a paper, book or other thing where I can find some information about inputsizes which are typically used in pratice. – chris000r Oct 27 '16 at 17:16
• What you normally feed into HKDF is data with high (overall) entropy and known structure and supplemental nonces / random values. The most that would be used in practice is about 1 kiB of input, usually you'll rather be looking at 64-384 bytes (in case of TLS both). – SEJPM Oct 27 '16 at 18:17
• KDF's have long been somewhat disregarded. Possibly because they have been hiding behind more general purpose algorithms such as hash functions, HMAC or other PRF's. So I would be very surprised if there is a paper or study on this subject specifically. – Maarten Bodewes Oct 27 '16 at 18:35

As indicated, KDF's themselves can have any input size. But you can of course take a look at protocols where they are used.

First of all, HKDF is a Key Based KDF. So if it is used with a secret key (the "Input Key Material") you'd expect it to have enough security on its own. So that would be key sizes of 128 to 256 bit (or, more likely, just 128 or 256 bit).

KBKDF's are frequently used to create session keys after key agreement, for instance HKDF in TLS 1.3 (draft). In that case the entropy is first extracted from the given master secret. In that case the input of the KDF is simply the output of the key agreement protocol. Usually that's DH or ECDH.

For DH the output size is the same as the size of the prime (e.g. 1,024, 2,048, 3,072 or 4,096 bits). Note that some older algorithms may not include leftmost bytes if the calculated secret is one byte or more smaller than the modulus. In TLS 1.3 the size of the secret will be identical to the modulus size (I know, because I hinted that feature to the mailing list, to make it symmetric with ECDH, and probably leaks less information through side channels).

For ECDH the size is usually the size of the $x$ coordinate, which is encoded as the same length as the key size. Look up often used domain parameters to get an idea of what is possible there.

Of course, the size of the Info field can be about anything. But usually it is a relatively short string, so you could just use 16 bytes or so to be on the safe side.

HKDF also may have a salt but that's a bit harder to guess, as I haven't seem it used yet. Salts normally are 64 or 128 bits, although a 256 bit salt is not unheard of.