Using the output of HKDF directly

Question

I am using HKDF with an IKM and salt, the OKM is used as the key for an HMAC operation. The HMAC algorithm is authenticating messages in a communications system

The salt is the concatenation of 2 nonces, 1 drawn drawn by each of the communicating nodes and can be found by any one observing the communications system

Messages are sent as:

message || sequence number || HMAC(key, sequence number || message)

My question is this: Is it safe to use the OKM directly as the key for the message HMAC or should I perform some other operation on the OKM before using it?

Answer 1

The whole idea of a KDF is to use the output of the key material as, well, an unpredictable key to an attacker. So as long as your IKM is secure and preferably your salt is unique, then the output of a KDF should be usable as key.

For HMAC it is best to use the same key size as the output of the hash algorithm used, as per HMAC spec:

The key for HMAC can be of any length (keys longer than B bytes are first hashed using H). However, less than L bytes is strongly discouraged as it would decrease the security strength of the function. Keys longer than L bytes are acceptable but the extra length would not significantly increase the function strength. (A longer key may be advisable if the randomness of the key is considered weak.)

You're correctly concatenating the nonces already to create the salt. Don't use XOR for that.

Um, yeah, I think there is all that there is to it. If you just need one key you can do with just HKDF-Extract which takes the IKM and, indeed, a salt.