Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hkdf]

HKDF is a key derivation function specified in RFC5869.

2
votes
1answer
68 views

What key is used to encrypt the certificate and certificate verify message in TLS1.3?

Which key is used to encrypt certificate and certificate verify message in TLS1.3? I could not figure out which one it is reading section 4.4.2 of RFC 8846 and I only saw a vague mention on page 11.
0
votes
1answer
44 views

What SALT value will be used in HKDF_EXTRACT in TLS1.3?

What SALT value will be used in HKDF_EXTRACT while generating the Handshake Secret (when there will not be any PSK)?
4
votes
1answer
123 views

Why derive keys from a master key instead of generating random keys?

I noticed AWS KMS generates encryption keys based off of a master key, using a key derivation function (HKDF). What's the practical advantage of deriving keys based on a master key? Isn't it simpler ...
1
vote
1answer
59 views

HKDF: Difference between salt and info

I want to do generate individual AES keys for a number of smart cards, based on a random master key (key diversification) and the serial number of the card. According to the answers to this question ...
1
vote
0answers
98 views

Which 'info' and 'salt' parameters to use in HKDF for TLS 1.3?

all the following discussion is for HKDF in TLS1.3: Regarding the 'salt' parameter in - HKDF-Extract(salt, IKM) as written in RFC 5869: HKDF without having to protect the secrecy of the salt. In ...
1
vote
1answer
28 views

Restricting output of key derivation function

Are there any suitable key derivation functions that allow the output to have certain constraints applied to them?` I know you can choose a length in some functions (HKDF for example), but what about ...
0
votes
1answer
35 views

Using key derived using HKDF or NIST sp800-108 with AES-CCM/GCM

Is it safe to use keys derived using HKDF or NIST sp800-108 with AES-CCM/GCM ? The NIST SP800-108 and SP*00-56C spec says "To comply with this Recommendation, the derived keying material shall not be ...
2
votes
1answer
48 views

HKDF on output key material of previous HKDF

I understand the typical way to use HKDF is to make one call to HKDF to obtain multiple keys. Is it safe to use HKDF the following way to generate different keys ? If not, why? key0 = HKDF-extract-...
3
votes
0answers
44 views

Orignal Krawczyk's HKDF vs latest NIST SP800-56C

I've noticed that the original HKDF in rfc5869 defines a feedback loop. So the pseudo-code is something like: ...
2
votes
1answer
78 views

How to select salt an IKM for HKDF

I have an application where I need to combine a Diffie-Hellman shared secret, with a user's password and derive a key. I'm investigating the possibility of using HKDF to as follows Initial Keying ...
2
votes
0answers
47 views

Why would one split HKDF output into multiple parts instead of expanding it multiple times

Reading the implementation details of Signal's approach on double ratchet algorithm I noticed the following key derivation procedure for using AES-CBC with HMAC: HKDF is used (...) to generate 80 ...
1
vote
2answers
118 views

Key derivation: bit lengths

This is a follow-up question to HKDF: ikm, salt and info values Based on the feedback, I have now decided to implement my key derivation for AES-GCM-256 file encryption roughly as follows: ...
2
votes
1answer
172 views

HKDF: ikm, salt and info values

As indicated at Key generation for AES-GCM-256 file encryption I'm currently working on a file encryption software. In the above thread it was suggested that, for performance reasons, I use a ...
3
votes
1answer
239 views

Where can I find official test vectors for NIST SP 800-56C r1 Single Step KDF

NIST 800-56Cr1 describes a single and two (extract-expand) step KDF designed for use in key agreement routines. NIST declares that HKDF (RFC5869) is a version of the two-step variation so test vectors ...
2
votes
1answer
183 views

HKDF - Generating a new, random salt per user?

Regarding HKDF, the specification says a salt may be re-used. However, I have set up my system to generate a new, long and cryptographically random salt that persists with the user. This salt is not ...
2
votes
1answer
90 views

Is using derived keys for HKDF + AES-GCM safe

I have an existing system which takes a cryptographically secure BLOB from user and pass it to lower API which calls HKDF-Expand to get 2 keys: one is effectively discarded in this scenario and second ...
0
votes
1answer
164 views

Good practices for AES key derivation and management

I'm developping a device based on STM32L4x6. It is connected through BLE to a smartphone and it exchanges encrypted data with it. Data consists of health data of patients. Encryption is AES-GCM 256 ...
1
vote
0answers
47 views

How to envision entropy concentration in HKDF “extract” stage?

RFC 5869: Thus, the goal of the "extract" stage is to "concentrate" the possibly dispersed entropy of the input keying material into a short, but cryptographically strong, pseudorandom key. The ...
1
vote
0answers
42 views

Question on inputs of PRFs and HKDF KDF

I've read a lot of information about PRNGs, PRFs and KDFs. As far as I know: PRNG: The seed for the PRNG must be a uniform string. It transforms a short real uniform string into some bits of pseudo-...
2
votes
1answer
52 views

Signing different types of messages with the same asymmetric key

I want to be able to sign different types of messages with the same asymmetric key. (For completeness, I am using Ed25519 for my signatures). Why do I want to do this? The same key is used to sign ...
3
votes
2answers
197 views

Using HKDF to derive symmetric keys from a hybrid public-key encryption scheme

RFC 5869 describes HMAC-based Extract-and-Expand Key Derivation Function (HKDF). In section 4, entitled "Applications of HKDF", it states that one of the intended uses is: derivation of symmetric ...
2
votes
2answers
321 views

Doing RSA-KEM with RSA-OAEP

I am fiddling around with the JS Web Crypto API and creating a hybrid encryption system that uses a symmetric key to encrypt form data with AES256-CBC and and a public/private key-pair to wrap/...
1
vote
1answer
499 views

TLS 1.3: HKDF-Expand

In RFC5869 I found that the function of the HKDF-Expand on the input assumes the parameter $L$ which denotes length of output keying material in octets ($\leq 255*\text{Hash}_{Length}$), and then the $...
-1
votes
2answers
132 views

Is HMAC a suitable substitute for HKDF?

My PHP version does not include the hash_hkdf() function, and upgrading versions is not worth the trouble for my project (which is for personal pleasure, not for ...
1
vote
0answers
126 views

HKDF to derive multiple keys from a strong constant master secret and a weaker changing secret

I am working with constrained nodes (type OpenMote CC2538) on a (constrained) 6TiSCH network and I am trying to design a good re-keying scheme designed to generate AES-128 keys dubbed Device ...
2
votes
0answers
61 views

Combining multiple hash functions for HKDF

I'm trying to apply the hash function combination method described in https://eprint.iacr.org/2013/210.pdf to a HKDF PRNG construction. Thing is it needs 4 uniformly random parameters/keys chosen by ...
0
votes
1answer
154 views

Properly securing a private key for remote storage

I am attempting to secure a private key for remote storage on an untrusted device. Here are the parameters and my assumptions, I'd like to confirm I'm correct with them. The keypair that I wish to ...
1
vote
0answers
136 views

Is it safe to re-use the salt for HKDF as a challenge for proof of possession after key derivation?

I have a system made of 2 or more parties, already sharing a master key MK, who want to agree on a session key SK (both 128-bit ...
1
vote
2answers
139 views

KDF-based password manager

I want to make a password manager that from a single master password generates passwords for my services. For that I thought that HKDF suits my needs, as it is able to generate multiple keys from a ...
1
vote
1answer
497 views

HMAC vs PKDBF2 as the first step towards HKDF

I'm implementing an application that from a password has to derive two keys, one for authentication with the server, one for encryption. I'm using Java, with JCA and Bouncy Castle. So far, to ...
4
votes
1answer
1k views

Clarification needed in TLS 1.2 key derivation process

Reference to TLS 1.2 standard documentation section 6.3 regarding the key generation here: To generate the key material, compute ...
1
vote
1answer
827 views

The number of keys generated in TLS 1.2?

In section 6.3. Key Calculation in the standard documentation here, I see the following: The master secret is expanded into a sequence of secure bytes, which is then split to a client write MAC ...
1
vote
2answers
268 views

how does hkdf generate 2 keys?

Hi I am new to cryptography and am confused as to how HKDF generates two separate keys from one single key/password. Is it as follows? Key 1: HKDF-Extract(salt, IKM) -> PRK Key 2: HKDF-Expand(PRK, ...
4
votes
1answer
482 views

Some Questions about the Veracrypt hash functions

Veracrypt has always been my favourite encryption tool since it came out . But still there are some things about the tool I don't understand . Why is there the possibility to use sha256 or sha512 . ...
4
votes
1answer
245 views

Negating the risk of a random 64-bit nonce

Given a stream cipher such as Chacha20, which uses a 64-bit nonce, it would be unsafe to use a random nonce because of the risk of accidental repetition (which if used twice with the same key would be ...
3
votes
2answers
1k views

How long to wait to feed hashing using SHA 256?

I have a source which generates secrets at $8-10 bits $ per second. I need to use this secret to feed another generator every second. I am wondering how long should I wait while I am concatenating 8 ...
0
votes
1answer
235 views

Cryptographic notation in X3DH Key Agreement Protocol

Can someone please explain the below paragraphs from section 2.2 in The X3DH Key Agreement Protocol? Please try to explain the whole paragraphs. 1st paragraph: I want to understand how the DH ...
1
vote
1answer
291 views

Is there a recommendation or standard for using SCRYPT as an unbounded length KDF and not a fixed length authentication hash?

How would I go about this? I don't want to roll my own but I do really want to use SCRYPT as a KDF for several algorithms, some of which require an output length longer than the SHA-256 hash. ...
2
votes
1answer
117 views

Security of HKDF when part of output is exposed

There is a system in which Alice and Bob need to establish a secure communication channel. Their conversation happens via a "public" server whose only purpose is to rely messages between users. This ...
4
votes
1answer
331 views

KDF vs Stream Cipher

I was wondering why someone would go and use HKDF (or any KDF) when they can use a stream cipher instead. It seems like a stream cipher will always be one-way, whereas a KDF might not be (see AES or ...
10
votes
1answer
515 views

Can someone clarify two things about the HKDF by Krawczyk?

I got a question about the HKDF Scheme by Hugo Krawczyk. On the following link you can find a small explanation of the HKDF-Scheme and some short informations. The HKDF specification itself has been ...
1
vote
1answer
143 views

Maximum output of HKDF

I got a question with the RFC of HKDF https://tools.ietf.org/html/rfc5869. There is a maximum specified for the output keying material. The length of the OKM shall be <= 255*HashLen. What does it ...
6
votes
2answers
962 views

Difference between RFC-5869 (HKDF) and SP800-108 (Nist's HMAC-based KDF spec)?

I'm trying to find the difference between the two aforementioned algorithms. It seems that one is either a subset of the other. Could someone explain the similarities/differences?
3
votes
1answer
643 views

What is the difference between KDFs for key derivation vs password stretching?

This was mentioned in the comments to another question: To clarify: This is about key-stretching KDFs. Not the kind for diversifying keys (eg. HKDF) and There are two kinds of KDF, the slow, ...
1
vote
1answer
518 views

Choosing between simple Hash and HKDF to derive the second key used for MAC

I have an encrypt function that takes a single encryption key and encrypts data but also incorporates an HMAC. So I need to derive a second key from the encryption key to use it for HMAC. You ...
4
votes
1answer
448 views

Faster alternative to HKDF

HKDF is used in one of my projects to derive separate keys from a common master key. But profiling has shown it to be the performance bottleneck under certain circumstances. Is there any faster ...
2
votes
1answer
314 views

Would it be better to use HKDF or SCrypt for deriving a child key?

Okay so I'm trying to derive a child public key from an EC public key. I've come up with a couple ideas and now I'd like to know which is more secure. Mp: The master key pair, this includes a ...
7
votes
1answer
1k views

Why does HKDF use HMAC(salt, key) instead of HMAC(key, salt)?

I've been looking over the HKDF specs (RFC 5869), and something I noticed is that in the key and salt are reversed: ...
4
votes
1answer
512 views

SHA512 vs HKDF key expansion

I'm working on a secure file storage server. This server allows users to upload and download files based on a "seed". This "seed" is a 128-bit value. From this 128-bit seed, we run SHA512 to derive a ...
2
votes
1answer
565 views

Can I use HKDF to improve security of HMAC used with weak hash function?

I am writing a framework which encrypts/decrypts files (or streams, in general) with symmetric key using block cipher (for example, AES). To authenticate encrypted file, I use HMAC, which is ...