Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hkdf]

HKDF is a key derivation function specified in RFC5869.

9
votes
1answer
455 views

Can someone clarify two things about the HKDF by Krawczyk?

I got a question about the HKDF Scheme by Hugo Krawczyk. On the following link you can find a small explanation of the HKDF-Scheme and some short informations. The HKDF specification itself has been ...
8
votes
4answers
1k views

Which risks are associated with deriving multiple keys from the same DH secret Z?

NIST recommends Krawczyk's HMAC-based key derivation function (HKDF) in SP-800-56C (PDF). HKDF shall e.g. be used to create keys from shared secrets after Diffie Hellman key establishment. NIST ...
7
votes
1answer
2k views

PBKDF vs HKDF for pretty long key

I'm developing a messenger application with encrypted chats. In the first version of the app I've used PBKDF2 (10000 iterations, SHA1, random salt) to extend a short user password and generate keys ...
7
votes
1answer
945 views

Why does HKDF use HMAC(salt, key) instead of HMAC(key, salt)?

I've been looking over the HKDF specs (RFC 5869), and something I noticed is that in the key and salt are reversed: ...
7
votes
1answer
422 views

repeated use of HKDF-extract on the same PRK

Regarding HKDF (RFC 5869) - HKDF has two steps, extract and expand. Some answers on this site suggest that you can extract once, and then generate multiple keys from the resulting PRK by multiple ...
6
votes
1answer
2k views

How is HKDF-Expand better than a simple hash?

Why do we need HKDF-Expand if we can simply hash the pseudorandom key to make it longer? The docs (in the link) say: The second stage "expands" the pseudorandom key to the desired length... Is ...
6
votes
1answer
360 views

multiple keys via HKDF - whats better, one or two applications of HKDF-extract

Assume for the sake of the question that I have two variable-length bit strings, each with 128 bit cryptographic randomness, and I want to extract two 128 bit keys via HKDF-SHA256. Which alternative ...
5
votes
1answer
495 views

Key collision in scrypt and hkdf

I am developing a mostly-offline authorization system that authorizes a user using an deterministically generated AuthKey derived from a MasterKey derived from a high-entropy chunk of data (128 bits) ...
5
votes
1answer
1k views

What information to include is the 'info' input for HKDF?

The RFC states the following: 3.2. The 'info' Input to HKDF While the 'info' value is optional in the definition of HKDF, it is often of great importance in applications. Its main objective ...
5
votes
1answer
865 views

Computing IV for CBC from PBKDF2 + HKDF

Note that this question is somewhat similar to Can I use my random IV (for AES) as a salt for PBKDF2? My current encryption format computes two random PBKDF2 salts (encryption and HMAC, 8 bytes each) ...
5
votes
1answer
779 views

Clarification needed in TLS 1.2 key derivation process

Reference to TLS 1.2 standard documentation section 6.3 regarding the key generation here: To generate the key material, compute ...
4
votes
1answer
387 views

Faster alternative to HKDF

HKDF is used in one of my projects to derive separate keys from a common master key. But profiling has shown it to be the performance bottleneck under certain circumstances. Is there any faster ...
4
votes
1answer
426 views

Some Questions about the Veracrypt hash functions

Veracrypt has always been my favourite encryption tool since it came out . But still there are some things about the tool I don't understand . Why is there the possibility to use sha256 or sha512 . ...
4
votes
1answer
220 views

Negating the risk of a random 64-bit nonce

Given a stream cipher such as Chacha20, which uses a 64-bit nonce, it would be unsafe to use a random nonce because of the risk of accidental repetition (which if used twice with the same key would be ...
4
votes
1answer
283 views

KDF vs Stream Cipher

I was wondering why someone would go and use HKDF (or any KDF) when they can use a stream cipher instead. It seems like a stream cipher will always be one-way, whereas a KDF might not be (see AES or ...
4
votes
1answer
832 views

Difference between RFC-5869 (HKDF) and SP800-108 (Nist's HMAC-based KDF spec)?

I'm trying to find the difference between the two aforementioned algorithms. It seems that one is either a subset of the other. Could someone explain the similarities/differences?
4
votes
1answer
486 views

What is the difference between KDFs for key derivation vs password stretching?

This was mentioned in the comments to another question: To clarify: This is about key-stretching KDFs. Not the kind for diversifying keys (eg. HKDF) and There are two kinds of KDF, the slow, ...
4
votes
1answer
482 views

SHA512 vs HKDF key expansion

I'm working on a secure file storage server. This server allows users to upload and download files based on a "seed". This "seed" is a 128-bit value. From this 128-bit seed, we run SHA512 to derive a ...
3
votes
2answers
1k views

How long to wait to feed hashing using SHA 256?

I have a source which generates secrets at $8-10 bits $ per second. I need to use this secret to feed another generator every second. I am wondering how long should I wait while I am concatenating 8 ...
3
votes
2answers
142 views

Using HKDF to derive symmetric keys from a hybrid public-key encryption scheme

RFC 5869 describes HMAC-based Extract-and-Expand Key Derivation Function (HKDF). In section 4, entitled "Applications of HKDF", it states that one of the intended uses is: derivation of symmetric ...
3
votes
1answer
93 views

Security of HKDF when part of output is exposed

There is a system in which Alice and Bob need to establish a secure communication channel. Their conversation happens via a "public" server whose only purpose is to rely messages between users. This ...
3
votes
1answer
925 views

How to calculate entropy of a combined key

I know how to calculate the entropy of a key that relates to its selection process. For example if the key space is $1000$, entropy of a randomly chosen key is $1000$. Suppose now you have two keys $X$...
3
votes
1answer
567 views

Using KDF output for password validation

I am currently revising an AES data format. I would like to determine whether a provided password/key is incorrect. Previously this was done by validating the HMAC, but this makes it impossible to ...
3
votes
1answer
1k views

KDF based on HMAC-SHA-256

Is KDF based on HMAC-SHA-256(Hashed Message Authentication Code, Secure Hash Algorithm) algorithm a suitable option to generate symmetric key from the secret key? What is the basic funda, behind ...
3
votes
1answer
1k views

Generating keys with HKDF from Diffie Hellman agreement

In order to generate multiple session keys from a Diffie Hellman key agreement protocol, I'm trying to use the HKDF to generate this session keys. The HKDF algorithm uses an Extraction-Expand ...
3
votes
1answer
114 views

Where can I find official test vectors for NIST SP 800-56C r1 Single Step KDF

NIST 800-56Cr1 describes a single and two (extract-expand) step KDF designed for use in key agreement routines. NIST declares that HKDF (RFC5869) is a version of the two-step variation so test vectors ...
2
votes
2answers
637 views

Wrong Test Vector for HKDF with HMAC-SHA256 [closed]

I have implemented HKDF by myself and it seems to work good. I managed to replicate all the test vectors listed here but... except this one: ...
2
votes
1answer
95 views

HKDF: ikm, salt and info values

As indicated at Key generation for AES-GCM-256 file encryption I'm currently working on a file encryption software. In the above thread it was suggested that, for performance reasons, I use a ...
2
votes
2answers
237 views

Doing RSA-KEM with RSA-OAEP

I am fiddling around with the JS Web Crypto API and creating a hybrid encryption system that uses a symmetric key to encrypt form data with AES256-CBC and and a public/private key-pair to wrap/...
2
votes
1answer
518 views

Can I use HKDF to improve security of HMAC used with weak hash function?

I am writing a framework which encrypts/decrypts files (or streams, in general) with symmetric key using block cipher (for example, AES). To authenticate encrypted file, I use HMAC, which is ...
2
votes
1answer
128 views

HKDF - Generating a new, random salt per user?

Regarding HKDF, the specification says a salt may be re-used. However, I have set up my system to generate a new, long and cryptographically random salt that persists with the user. This salt is not ...
2
votes
1answer
48 views

Signing different types of messages with the same asymmetric key

I want to be able to sign different types of messages with the same asymmetric key. (For completeness, I am using Ed25519 for my signatures). Why do I want to do this? The same key is used to sign ...
2
votes
1answer
259 views

HKDF entropy extraction

I collect entropy from the following sources: system_entropy = System provided crypto entropy stream (CryptGenRandom on Windows) user_entropy = User-provided entropy - in a form of a byte stream of ...
2
votes
1answer
547 views

Key derivation for AES-Encryption key and HMAC

Okay so I have two options for how I would derive two keys for AES encryption and HMAC they are as follows: Run BCrypt on a users passphrase and then use the bouncy castle implementation of HKDF in ...
2
votes
1answer
51 views

How to select salt an IKM for HKDF

I have an application where I need to combine a Diffie-Hellman shared secret, with a user's password and derive a key. I'm investigating the possibility of using HKDF to as follows Initial Keying ...
2
votes
1answer
58 views

Is using derived keys for HKDF + AES-GCM safe

I have an existing system which takes a cryptographically secure BLOB from user and pass it to lower API which calls HKDF-Expand to get 2 keys: one is effectively discarded in this scenario and second ...
2
votes
0answers
58 views

Combining multiple hash functions for HKDF

I'm trying to apply the hash function combination method described in https://eprint.iacr.org/2013/210.pdf to a HKDF PRNG construction. Thing is it needs 4 uniformly random parameters/keys chosen by ...
1
vote
1answer
404 views

Choosing between simple Hash and HKDF to derive the second key used for MAC

I have an encrypt function that takes a single encryption key and encrypts data but also incorporates an HMAC. So I need to derive a second key from the encryption key to use it for HMAC. You ...
1
vote
2answers
122 views

KDF-based password manager

I want to make a password manager that from a single master password generates passwords for my services. For that I thought that HKDF suits my needs, as it is able to generate multiple keys from a ...
1
vote
2answers
92 views

Key derivation: bit lengths

This is a follow-up question to HKDF: ikm, salt and info values Based on the feedback, I have now decided to implement my key derivation for AES-GCM-256 file encryption roughly as follows: ...
1
vote
1answer
391 views

HMAC vs PKDBF2 as the first step towards HKDF

I'm implementing an application that from a password has to derive two keys, one for authentication with the server, one for encryption. I'm using Java, with JCA and Bouncy Castle. So far, to ...
1
vote
1answer
675 views

The number of keys generated in TLS 1.2?

In section 6.3. Key Calculation in the standard documentation here, I see the following: The master secret is expanded into a sequence of secure bytes, which is then split to a client write MAC ...
1
vote
1answer
124 views

Maximum output of HKDF

I got a question with the RFC of HKDF https://tools.ietf.org/html/rfc5869. There is a maximum specified for the output keying material. The length of the OKM shall be <= 255*HashLen. What does it ...
1
vote
2answers
1k views

Deriving 2 keys using HKDF

I have an encryption scheme that uses a 256-bit master key, from which 2 separate keys (one for AES-256-CTR encryption and one for a HMAC-SHA256) are derived using HKDF. However, I'm not sure exactly ...
1
vote
1answer
232 views

Is there a recommendation or standard for using SCRYPT as an unbounded length KDF and not a fixed length authentication hash?

How would I go about this? I don't want to roll my own but I do really want to use SCRYPT as a KDF for several algorithms, some of which require an output length longer than the SHA-256 hash. ...
1
vote
2answers
315 views

How to use HKDF to combine two keys

I have heard that to combine two keys HKDF is better than using XOR function. But if you look at the HKDF RFC I could not figure out how to use it for concatenating two keys. What I can see is HKDF ...
1
vote
1answer
354 views

TLS 1.3: HKDF-Expand

In RFC5869 I found that the function of the HKDF-Expand on the input assumes the parameter $L$ which denotes length of output keying material in octets ($\leq 255*\text{Hash}_{Length}$), and then the $...
1
vote
2answers
218 views

how does hkdf generate 2 keys?

Hi I am new to cryptography and am confused as to how HKDF generates two separate keys from one single key/password. Is it as follows? Key 1: HKDF-Extract(salt, IKM) -> PRK Key 2: HKDF-Expand(PRK, ...
1
vote
1answer
277 views

Would it be better to use HKDF or SCrypt for deriving a child key?

Okay so I'm trying to derive a child public key from an EC public key. I've come up with a couple ideas and now I'd like to know which is more secure. Mp: The master key pair, this includes a ...
1
vote
0answers
35 views

Why would one split HKDF output into multiple parts instead of expanding it multiple times

Reading the implementation details of Signal's approach on double ratchet algorithm I noticed the following key derivation procedure for using AES-CBC with HMAC: HKDF is used (...) to generate 80 ...