# Which risks are associated with deriving multiple keys from the same DH secret Z?

NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment.

NIST states in the same doc:

Each call to the randomness extraction step requires a freshly computed shared secret $Z$, and this shared secret shall be zeroized immediately following its use in the extraction process.

Why is it not recommended to derive multiple keys from the same $Z$, e.g. why not derive a key for data encryption and a key for authentication from the same $Z$ using different info strings? If I still do it, what weaknesses might the derived keys be facing? Is it simply bad practice (without deep explanation) to do so since the derived keys obviously are related? Krawczyk seems to think that multiple derivations from the secret are expected use (see section 3.2 in RFC 5869, my interpretation).

Does salting the HKDF with a good random salt change my risks when deriving multiple keys from a single $Z$?

The engineering answer is that, in practice, if you generate two keys using two different info strings, I suspect you'd probably get away with it without problems. If we model the hash as a random oracle (admittedly a very strong "assumption"), then I suspect it might be possible to demonstrate that what you propose is OK. Disclaimers: I haven't analyzed this, and I'm certainly not going to give you any guarantees -- if you do what you propose, cryptographers will wag their finger and say "tsk, tsk", and rightly so. I suspect you'd probably get away with it (it's not the worst sin you could make), but if something does go wrong, cryptographers aren't going to take the blame -- it's all on you.

The more principled answer is that if you do what you propose, you are misusing the HKDF primitive. The HKDF is only intended to be applied to a single $Z$ once. It is intended to turn an unguessable value into something that looks uniformly random. It has been analyzed for that use. It was not designed to derive multiple keys from the same $Z$: it hasn't been analyzed for that kind of use case, since that's not what it was designed for. So, you're throwing away the benefits you could get from the public analysis of HKDF if you use it in a way that it wasn't designed for.

Consequently, given that it is so easy to apply a PRG or PRF to the output of HKDF (using HKDF to get a uniform-random key, and using a PRG or PRF for key separation, i.e., to derive two different keys), you should probably do that, instead of what you proposed. Given that it is so easy to do the principled things, you might as well do the principled thing, and use the HKDF only once on any given $Z$. Even though you could probably get away with cutting corners and doing what you proposed, I see no reason to take the risk (even if the risk is miniscule).

So, stick to using HKDF in the way that its specification tells you to. Don't cut corners. In this case, there's not really any compelling reason to deviate from standard cryptographic practice, so you might as well stick with what the specification and cryptographers recommend.

• As HKDF has a variable-length output, couldn't we just produce enough output for both keys and then split it in two, instead of using another PRF after HKDF? – Paŭlo Ebermann Nov 15 '12 at 23:14
• @PaŭloEbermann, good point, yes, I think that would be OK too. – D.W. Nov 15 '12 at 23:52
• this is what is done in TLS. They use HKDF on a shared secret to produce enough keys. – David 天宇 Wong Oct 18 '16 at 20:19
• Isn't the point of the info parameter of the Expand phase so that you can derive multiple keys? – Cocowalla May 8 '18 at 21:12

A key derivation function is intuitively "purifying" the entropy in the group element Z into uniformly random (looking) bits that can used as a key for other purposes. It is not designed to produce "multiple keys" from the same Z, and one should definitely not call the KDF on the same Z twice (even with different salts) and expect to get two independent keys.

If you want more key material beyond the output of one call to the KDF, the high level approach should be to apply the KDF to Z only once to get a single key, and then apply a pseudorandom generator (e.g., AES in counter mode) to that key to get multiple keys. This approach will be sound in the sense that it can proven secure in an appropriate model, assuming Z is pseudorandom, the KDF meets a natural notion of "purifying," and the pseudorandom generator is secure.

• So HKDF (not being any old KDF but e.g. HMAC-SHA-256/512 based) is still not providing the step of applying a pseudorandom generator? – NotACryptographer Nov 13 '12 at 14:53
• The output of K = HKDF(Z,r) will look like a random key when Z is a random group element and r is a random salt. But K1 = HKDF(Z,r) and K2 = HKDF(Z,r') will not look like two independent random keys, even when the salts r,r' are independent (at least this is the case with the concept of KDFs I am familiar with). However, if we take (K1,K2) = PRG(HKDF(Z,r)), then they will look random and independent. – David Cash Nov 13 '12 at 16:48

What you propose—using the intermediate derivation key $K_{\mathit{DK}}$ from a single input $Z$ to derive many output keys with distinct info strings—is perfectly fine.

The excerpt you quoted is about the HKDF-Extract step, not the HKDF-Expand step. What it is saying is that you should not use the same $Z$ with many different salts for HKDF-Extract: use it with one salt, and then erase it. That excerpt says nothing about HKDF-Expand with different info strings, however.

RFC 5869 is clearer on the point (emphasis added):

HKDF follows the "extract-then-expand" paradigm, where the KDF logically consists of two modules. The first stage takes the input keying material and "extracts" from it a fixed-length pseudorandom key K. The second stage "expands" the key K into several additional pseudorandom keys (the output of the KDF).

The standard security reduction for HKDF applies to an adversary who can query HKDF-Expand for many info strings adaptively, with the theorem parametrized by the number of queries, so your proposed use falls squarely within the intended and studied use of HKDF. This applies whether or not you use a salt.

You could generate a single key out of HKDF-Extract and HKDF-Expand, and feed it into another PRF to derive more keys. But to do so would be silly when HKDF-Expand already does exactly that.

The HKDF RFC contains formulations such as:

The second stage "expands" the key K into several additional pseudorandom keys (the output of the KDF).

and:

The second stage "expands" the pseudorandom key to the desired length; the number and lengths of the output keys depend on the specific cryptographic algorithms for which the keys are needed.

Both quotes appear already in the introduction (emphases mine).

As you already point out, Section 3.2 describes the info value and states:

In particular, it may prevent the derivation of the same keying material for different contexts (when the same input key material (IKM) is used in such different contexts).

All these quotes taken together seem to rather strongly indicate that deriving several keys from the same IKM is a perfectly valid and even intended use case of HKDF.

However, there is also a rather strong caveat in the introduction:

In many applications, the input keying material is not necessarily distributed uniformly, and the attacker may have some partial knowledge about it (for example, a Diffie-Hellman value computed by a key exchange protocol) ...

The concrete case of DH key exchange is thus even explicitly mentioned as one case where an attacker has partial knowledge of the IKM.

It would thus seem prudent to base the derivation of further keys on a new shared secret in this particular case of IKM.