# What SALT value will be used in HKDF_EXTRACT in TLS1.3?

What SALT value will be used in HKDF_EXTRACT while generating the Handshake Secret (when there will not be any PSK)?

The relevant text at the end of section 7.1 that explains this is:

If a [PSK or ECDHE] secret is not available, then the 0-value consisting of a string of Hash.length bytes set to zeros is used. Note that this does not mean skipping rounds, so if PSK is not in use, Early Secret will still be HKDF-Extract(0, 0).

This means that when a PSK is not used, the first step in key derivation is to compute the Early Secret (which is a fixed value that depends only on the selected HKDF hash function).

Following the main flow chart in section 7.1, feed Early Secret through Derive-Secret once, and the result is the salt argument for HKDF-Expand for the Handshake Secret calculation.

early_secret_no_psk_sha256 = "33ad0a1c607ec03b09e6cd9893680ce210adf300aa1f2660e1b22e10f170f92a"


And finally the HKDF-Expand salt for Handshake Secret is obtained when you invoke Derive-Secret(., "derived", "") on the Early Secret. For SHA-256, you end up with:

handshake_secret_salt_no_psk_sha256 = "6f2615a108c702c5678f54fc9dbab69716c076189c48250cebeac3576c3611ba"


Since these values contain no entropy, you don't need to compute them every time (again, assuming a PSK is not used). These values can be derived by anyone from the RFC text and depend only on the selected HKDF hash function.