What SALT value will be used in HKDF_EXTRACT while generating the Handshake Secret (when there will not be any PSK)?


The relevant text at the end of section 7.1 that explains this is:

If a [PSK or ECDHE] secret is not available, then the 0-value consisting of a string of Hash.length bytes set to zeros is used. Note that this does not mean skipping rounds, so if PSK is not in use, Early Secret will still be HKDF-Extract(0, 0).

This means that when a PSK is not used, the first step in key derivation is to compute the Early Secret (which is a fixed value that depends only on the selected HKDF hash function).

Following the main flow chart in section 7.1, feed Early Secret through Derive-Secret once, and the result is the salt argument for HKDF-Expand for the Handshake Secret calculation.

early_secret_no_psk_sha256 = "33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a"

And finally the HKDF-Expand salt for Handshake Secret is obtained when you invoke Derive-Secret(., "derived", "") on the Early Secret. For SHA-256, you end up with:

handshake_secret_salt_no_psk_sha256 = "6f2615a108c702c5678f54fc9dbab69716c076189c48250cebeac3576c3611ba"

Since these values contain no entropy, you don't need to compute them every time (again, assuming a PSK is not used). These values can be derived by anyone from the RFC text and depend only on the selected HKDF hash function.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.