I'm trying to find the difference between the two aforementioned algorithms. It seems that one is either a subset of the other. Could someone explain the similarities/differences?


RFC-5869 is about the "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)", while NIST SP-800-108 gives "Recommendation for Key Derivation Using Pseudorandom Functions". The main difference between Extract-and-Expand KDFs and KDFs based on PRFs are the requirements on the input keying material.

A PRF requires a uniform random key, which implies that the key must have a high entropy. So, in case of the NIST SP-800-108 versions of HMAC based KDFs it is assumed that you provide a random key at the beginning.

The HKDF scheme from RFC-5869 (and also NIST SP-800-56c) was originally proposed by Hugo Krawczyk in [1] as extract-then-expand KDF. As the name suggests, the function works in two steps. First, a key for key-derivation is extracted from the input keying material and a salt. The next step is essentially what SP-800-108 defines: use an HMAC (i.e. PRF based) KDF to derive further keys. The difference between SP-800-108 and RFC-5869 is the randomness extraction. With an extract-then-expand KDF you can use for example a shared secret to derive cryptographic keys and you must not provide a random key as input.

[1]. Hugo Krawczyk, "Cryptographic Extraction and Key Derivation: The HKDF Scheme", 2010, https://eprint.iacr.org/2010/264


Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.