Im trying to use HKDF after DIffie-hellman key exchange. However, i got stuck on HKDF part.

from Crypto.Protocol import HKDF
from Crypto.Hash import SHA512
from Crypto.Random import get_random_bytes

salt = get_random_bytes(16)
key1, key2 = HKDF(master_secret, 32, salt, SHA512, 2)

From my understanding, i only need one key for the CHACHA20 or AES256-GCM. Is it a good idea if i only generate one key by HKDF?

One more thing, how can i generate good salt for this case?

  • $\begingroup$ Hi kelalaka, Thanks for your comment. I have read through the content from your shared hyperlink. I don't get it. You mean i can skip the expand process and use expand directly? However, if i get OKM from expand process, why do i need to derive salts? $\endgroup$ – Lyf Lan Apr 11 at 11:12
  • $\begingroup$ The salt in HKDF is used to concentrate a possible weak input into short good PRK with the help of a salt. You can skip extract since your key is a Pseudo Random Key. In the Exapand Paradign, use the info to derive even multiple keys. For a nonce generation, see How to generate a nonce for ChaCha20 Poly1305?. The nonce generation is valid for AES-GCM, too. $\endgroup$ – kelalaka Apr 11 at 12:26
  • $\begingroup$ That is exactly what i wanted. Really appreciate! One more thing, how to generate the info part? I have read through the HKDF info part from IETF. It said that it should be independent of the input key material value IKM. Do you have any recommendations? Should info always be different for each communication? $\endgroup$ – Lyf Lan Apr 11 at 13:11
  • $\begingroup$ "From my understanding, i only need one key" - depends on what you're doing. If you're encrypting in one direction (perhaps encrypting a single message), that's fine. If you're protecting bidirectional traffic (both traffic Alice ends to Bob and what Bob sends to Alice) with the keys generated by a single DH, it'd probably be better to use two keys (one to protect the 'Alice->Bob' traffic and another one to protect the 'Bob->Alice' traffic $\endgroup$ – poncho Apr 11 at 13:26
  • $\begingroup$ info is selective, like Key1 for the first key then key2, for the 2nd key. Since the DHKE will create different keys ( assuming the users have access to good random source with high entropy) using the same info in different site is no problem, $\endgroup$ – kelalaka Apr 11 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.