I've noticed that the original HKDF in rfc5869 defines a feedback loop. So the pseudo-code is something like:

for i = 1...n
    out[i] = HMAC(key, out[i - 1] + i + info)

However, the NIST recommendation 800-56C seems to only depend on a loop counter for each round:

for i = 1...n
    out[i] = HMAC(key, i + info)

From a security perspective, is there any significant weakness if we don't do the feedback loop?

  • 1
    $\begingroup$ The second NIST document doesn’t seem to contain the string HMAC at all. I don’t think it is meant as a specification of HMAC but as a definition of an NIST-approved KDF that works with several hash/MAC functions but is not in fact HMAC. $\endgroup$ – rmalayter Apr 11 '19 at 18:16
  • $\begingroup$ Yes, the second document is more generic and works with various hash/MAC. I'm just wondering if there are any significant weakness assuming i choose the same hash/HMAC? $\endgroup$ – sonofusion82 Apr 25 '19 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.