Regarding HKDF (RFC 5869) - HKDF has two steps, extract and expand.
Some answers on this site suggest that you can extract once, and then generate multiple keys from the resulting PRK by multiple invocations of HKDF-expand (with different info strings).
Other answers say this is not how HKDF should be used, and possibly not safe. However, using HKDF-expand to generate a longer key (say, 256 bits) and then splitting it would be ok. (See D.W.'s answer in Which risks are associated with deriving multiple keys from the same DH secret Z? for example).
When I originally read the RFC I got the impression that it is fine to generate multiple keys from the same PRK using different info strings, but re-reading it, I can't see this being substantiated anywhere, i.e., the RFC does not explicitly allow multiple HKDF-expands on the same PRK (and implicitly seems to not support it).
- can HKDF-expand be used multiple times on the same PRK/HKDF-extract result?
- if not, is it safe to generate a longer key using expand and split it?