# TLS 1.3: HKDF-Expand

In RFC5869 I found that the function of the HKDF-Expand on the input assumes the parameter $L$ which denotes length of output keying material in octets ($\leq 255*\text{Hash}_{Length}$), and then the $N$ is computed as $\operatorname{ceil}(L/\text{Hash}_\text{Length})$ and $L$ is a multiple of $\text{Hash}_\text{Length}$, i.e. the number of output blocks equals $N\in [1,..,255]$.

But when analyzing the use of this function in TLS 1.3 to form a key schedule, I see that the input of this function for $L$ parameter is Hash.length when calling the Derive-Secret function for each generated key:

DeriveSecret(EarlySecret, "ext binder" | "res binder", "") = HKDF-Expand-Label(EarlySecret, "ext binder" | "res binder" | Hash(""), Hash.length ) = HKDF-Expand(EarlySecret, "ext binder" | "res binder" | Hash(""), Hash.length)

i.e. $L$ = Hash.length and $N = 1$? And so for each key.

I'm sure that I'm wrong somewhere but I do not understand where.

• I made some edits to your question to hopefully improve the readability - please ensure that I did not accidentally change the meaning of your question. – Ella Rose Apr 22 '18 at 23:21
• These keys don't seem to be directly used as session keys. A key the size of the hash makes sense as it provides the maximum of security, minimum of processing and it doesn't require any post-processing of the output keying material. – Maarten Bodewes Apr 25 '18 at 0:26
• Maarten Bodewes, then what is the difference between the functions used to diversify the keys - HKDF.Extract and HKDF.Expand, if HKDF.Expand works for one round ? – Kirill Voevodin Apr 25 '18 at 9:18
• Sorry if I could not get back to you at the time (life was happening to me in April 2018). Could you have a look at the given answer? HKDF Extract is used to compress entropy, HKDF expands compressed entropy using the given info and output size. I'm not sure why HKDF-Extract is not used for TLS. – Maarten Bodewes Dec 27 '18 at 15:30