# Is HKDF one-way, namely given Ko it's hard to guess Ki?

For background, a HKDF (hmac based key derivation function) takes the form of Ko = KDF(Ki, Label, Context, Len) where Ki is the input key and Ko is the (usually longer) output key, computed by iteratively applying HMAC (initially keyed by Ki) until the desired length is reached. See pseudocode here.

Can I assume HKDF is one-way, namely given Ko it's hard to guess Ki? It seems intuitive, as HMAC output should not lead to recovery of the MAC key.

• This security property should probably follow rather straightforwardly from HKDF's formal security proofs and analysis. Here's the paper in case I don't find time to write things up myself. – SEJPM Nov 25 '20 at 21:51

A KDF is secure if an adversary cannot make a distinction between the output of the KDF and random output (with a larger probability of $${1 \over 2} + \epsilon$$). The attacker gets to know the salt and is able to choose the $$Info$$ parameter and output size (i.e. all the other input parameters) as well as any previous output. This is basically a plaintext excerpt of chapter 3 of the original paper "Cryptographic Extraction and Key Derivation: The HKDF Scheme".