KDF such as scrypt is memory (cpu) demanding so that the attackers cannot quickly decrypt the key.

Why use HKDF? What's the application of it? If the attacker knows the input space of HKDF, and since the procedure of HKDF is public, what's the extra benefit of using it?

  • Why use HKDF?

From the default source Wikipedia; for KDF;

In conjunction with non-secret parameters to derive one or more keys from a common secret value (which is sometimes also referred to as "key diversification"). Such use may prevent an attacker who obtains a derived key from learning useful information about either the input secret value or any of the other derived keys.

Another HKDF use is;

It can be used, for example, to convert shared secrets exchanged via Diffie–Hellman into key material suitable for use in encryption, integrity checking or authentication.

From a single password to produce more secret keys.

  • What's the application of it?

Again Wikipedia; quite clear;

  1. To "extract" (condense/blend) entropy from a larger random source to provide a more uniformly unbiased and higher entropy but smaller output (e.g. an encryption key).
  2. To "expand" the generated output of an already reasonably random input such as an existing shared key into a larger cryptographically independent output, thereby producing multiple keys deterministically from that initial shared key, so that the same process may produce those same secret keys safely on multiple devices, as long as the same inputs are utilised.

  • If the attacker knows the input space of HKDF, and since the procedure of HKDF is public, what's the extra benefit of using it?

The procedure is public but not the Key, HKDF uses an HMAC as HMAC-SHA256.

That is why you are advised to have a good password; again from Wikipedia

Note: HKDF does not amplify entropy but does allow a large source of weaker entropy to be utilised more evenly and effectively.

For example; If the attacker accesses the key of HKDF, he still he needs to know your password. If your password weak, fear from hashcat.

If it has only successfully to break the database there is also salt and paper to protect the attacks apart from the key.


HKDF is not used to generate a secret key from a public input or a low-entropy password. It's used to derive a key from some secret input (e.g., a DH result) with high entropy.


Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.