6
$\begingroup$

I'm trying to find the difference between the two aforementioned algorithms. It seems that one is either a subset of the other. Could someone explain the similarities/differences?

$\endgroup$
5
$\begingroup$

RFC-5869 is about the "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)", while NIST SP-800-108 gives "Recommendation for Key Derivation Using Pseudorandom Functions". The main difference between Extract-and-Expand KDFs and KDFs based on PRFs are the requirements on the input keying material.

A PRF requires a uniform random key, which implies that the key must have a high entropy. So, in case of the NIST SP-800-108 versions of HMAC based KDFs it is assumed that you provide a random key at the beginning.

The HKDF scheme from RFC-5869 (and also NIST SP-800-56c) was originally proposed by Hugo Krawczyk in [1] as extract-then-expand KDF. As the name suggests, the function works in two steps. First, a key for key-derivation is extracted from the input keying material and a salt. The next step is essentially what SP-800-108 defines: use an HMAC (i.e. PRF based) KDF to derive further keys. The difference between SP-800-108 and RFC-5869 is the randomness extraction. With an extract-then-expand KDF you can use for example a shared secret to derive cryptographic keys and you must not provide a random key as input.

[1]. Hugo Krawczyk, "Cryptographic Extraction and Key Derivation: The HKDF Scheme", 2010, https://eprint.iacr.org/2010/264

$\endgroup$
1
$\begingroup$

I think it worth adding here RFC5869 allows to skip the "extract" phase of the algorithm. if the input key material may already be present as a cryptographically strong key has a good entropy and length of the hash output at least, the extract phase can be skipped.

$\endgroup$
1
  • $\begingroup$ FWIW, I found this helpful. I was trying to implement RFC5869 and while testing we were using Expand-Only. We have a pseudo-random input to start with, but, the only "online calc" (asecuritysite.com/encryption/hkdf) we could find uses the RFC examples and Exp+Extr so we couldn't confirm. I wasn't able to find any example output or resources for Expand-Only so while we didn't need it, it was easier to do the math. $\endgroup$ – mint branch conditioner Jan 19 at 0:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.