# How to envision entropy concentration in HKDF “extract” stage?

Thus, the goal of the "extract" stage is to "concentrate" the possibly dispersed entropy of the input keying material into a short, but cryptographically strong, pseudorandom key.

The implementation:

HKDF-Extract(salt, IKM) -> PRK

PRK = HMAC-Hash(salt, IKM)


Here salt may be 0. In this case, it feeds IKM into HMAC with a fixed key:

PRK = H(opad || H(ipad || IKM))


How to envision this as a concentration of entropy? How is this different than simply hash the IKM:

PRK = H(H(IKM))


Or:

PRK = H(IKM)

• It's not, really, but people seem to like HMAC. Perhaps a clearer choice would be BLAKE2b(salt=salt, message=IKM). – Squeamish Ossifrage Jul 14 '18 at 15:25