HKDF - Generating a new, random salt per user?

Regarding HKDF, the specification says a salt may be re-used.

However, I have set up my system to generate a new, long and cryptographically random salt that persists with the user. This salt is not a secret. (See the RFC, section 3.1)

In addition, I am taking our unique user identifier and using it as context info for the third parameter in HKDF.

So our HKDF looks like this:

DK = HKDF(MasterKey, PublicUserSpecificSalt, UUID)


My questions are:

1. Are there any issues with creating a random, user-specific salt, and using this for the salt input in HKDF? It seems the spec expects the salt to be re-used, which I am not doing.
2. If I do use a random, user-specific salt, what is the benefit of the UUID as context info? Should I just remove it, since it would add unnecessary complexity?
• @R1w Please don't make minimal edits until we don't have to perform an additional review, this is just not worth the cost. Sep 19 '18 at 23:02

1 Answer

By HKDF, I guess you mean HKDF-Expand, which takes as input a pseudorandom key, a label, and the output length. A public label is OK, but it is better unique rather than random due to HKDF-Expand's pseudorandom function security. I think using UUID only as the label is good enough.

• Hi! Thanks for your answer! Just to clarify -- by unique, do you mean a unique value that is shared across all users, or a value that is unique to that user?
– jrl
Sep 20 '18 at 17:58
• @jrl If the server uses the same master key for all users, then the salt should be unique among all users. Sep 20 '18 at 18:21
• The HKDF function that takes a salt is HKDF-Extract, not HKDF-Expand. Sep 21 '18 at 0:05