I'm trying to find the difference between the two aforementioned algorithms. It seems that one is either a subset of the other. Could someone explain the similarities/differences?
6
$\begingroup$
$\endgroup$
5
$\begingroup$
$\endgroup$
RFC-5869 is about the "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)", while NIST SP-800-108 gives "Recommendation for Key Derivation Using Pseudorandom Functions". The main difference between Extract-and-Expand KDFs and KDFs based on PRFs are the requirements on the input keying material.
A PRF requires a uniform random key, which implies that the key must have a high entropy. So, in case of the NIST SP-800-108 versions of HMAC based KDFs it is assumed that you provide a random key at the beginning.
The HKDF scheme from RFC-5869 (and also NIST SP-800-56c) was originally proposed by Hugo Krawczyk in [1] as extract-then-expand KDF. As the name suggests, the function works in two steps. First, a key for key-derivation is extracted from the input keying material and a salt. The next step is essentially what SP-800-108 defines: use an HMAC (i.e. PRF based) KDF to derive further keys. The difference between SP-800-108 and RFC-5869 is the randomness extraction. With an extract-then-expand KDF you can use for example a shared secret to derive cryptographic keys and you must not provide a random key as input.
[1]. Hugo Krawczyk, "Cryptographic Extraction and Key Derivation: The HKDF Scheme", 2010, https://eprint.iacr.org/2010/264
0
$\begingroup$
$\endgroup$
I think it worth adding here RFC5869 allows to skip the "extract" phase of the algorithm. if the input key material may already be present as a cryptographically strong key has a good entropy and length of the hash output at least, the extract phase can be skipped.
