repeated use of HKDF-extract on the same PRK

Question

Regarding HKDF (RFC 5869) - HKDF has two steps, extract and expand.

Some answers on this site suggest that you can extract once, and then generate multiple keys from the resulting PRK by multiple invocations of HKDF-expand (with different info strings).

Other answers say this is not how HKDF should be used, and possibly not safe. However, using HKDF-expand to generate a longer key (say, 256 bits) and then splitting it would be ok. (See D.W.'s answer in Which risks are associated with deriving multiple keys from the same DH secret Z? for example).

When I originally read the RFC I got the impression that it is fine to generate multiple keys from the same PRK using different info strings, but re-reading it, I can't see this being substantiated anywhere, i.e., the RFC does not explicitly allow multiple HKDF-expands on the same PRK (and implicitly seems to not support it).

So:

• can HKDF-expand be used multiple times on the same PRK/HKDF-extract result?
• if not, is it safe to generate a longer key using expand and split it?

Answer 1

Taken directly from the RFC:

The second stage "expands" the pseudorandom key to the desired
length; the number and lengths of the output keys depend on the
specific cryptographic algorithms for which the keys are needed.

The use of the plural here suggests (at least to me) that yes, it's ok to expand the same PRK several times with different contexts. Can you provide any links (within SE or otherwise) that suggest otherwise?

Also from the RFC, regarding the 'info' parameter of the expand step:

In particular, it may prevent the derivation of the same keying material for different contexts (when the same input key material (IKM) is used in such different contexts).