I understand the typical way to use HKDF is to make one call to HKDF to obtain multiple keys. Is it safe to use HKDF the following way to generate different keys ? If not, why?
key0 = HKDF-extract-and-expand(0 salt, Z(DH key exchange), x co-ordinates of public points as info).
key1 = HKDF-expand(key0, info1)
key2 = HKDF-expand(key1, info2)
Also, is it safe to replace HKDF-expand for key1 and key2 with sp800-108 or HMAC_SHA256(key0, counter)? i'm curious if there are any subtle differences between them that make them not interchangeable ?