# How does order in KDF formula affect its security proof?

If the expansion phase of key derivation is captured by the abstract formula (per Krawczyk):

KM = PRF* (PRK, CTX, L)

Then what happens to the security proofs if someone were to swap PRK and CTX. For example, they insert random but not secret number as the first argument and use the secret in their CTX formation?

If I literarily use the proof in Appendix A, Definition 14 of Krawczyk's paper "Cryptographic Extraction and Key Derivation: the HKDF Scheme", it seems that the attacker would gain a great advantage by swapping PRK and CTX. If the attacker knows PRK, he can always differentiate the output of PRF from random regardless how secret CTX is. Is this enough to prove that the swap is a bad idea.

Furthermore, are there any known practical attacks on this swap?

• If you swap CTX (context info) with PRK then you swap the key of HMAC with the input. But I argue that since we expect that PRK is secret not CTX. Let assume the contrary, the CTX is not expected to be random. But still not clear how you can distinguish HMAC if CTX is used as key. HMAC has distingusher if HAVAL, MD4, and SHA-0 is used. – kelalaka Feb 12 at 20:03