Overview
HKDF first extracts a pseudorandom key from input material, then expands it into one or more context-specific keys.
ExtendedSource checked
HKDF
Derives strong key material from shared secrets using HMAC-based extract and expand steps.
Quick Facts
Compact metadata for implementation and discovery.
- Category
- Cryptography
- Difficulty
- Intermediate
- Family
- Key Derivation
- Tier
- Extended
- Status
- Verified
- Review
- Source Checked
- Sources
- 1
- Formulas
- 2
- Relationships
- 5
- Code example
- Not ready
- Visualization
- Ready
Core Concepts
extract stepexpand stepHMACdomain separation
Quick facts
Complexity
Runtime and memory behavior at a glance.
Best
O(n)
Average
O(n)
Worst
O(n)
Space
O(1) besides output
When to Use
- Use when one shared secret must produce multiple purpose-specific keys.
- Use when deriving session keys is a central requirement.
When Not to Use
- Avoid when password hashing is needed; use a password hashing function instead.
- Avoid when a reviewed library or protocol already provides the needed security property.
What It Does
- Extracts a pseudorandom key
- Expands labeled output blocks
- Separates keys by context
Use Cases
- Deriving session keys
- Expanding Diffie-Hellman secrets
- Protocol key separation
Inputs
- Input key material
- Salt
- Context info
- Output length
Outputs
- Derived key bytes
Key Formulas (2)
Extract
PRK = HMAC(salt, inputkey material)
PRK = HMAC(salt, input_key_material)Turns input key material into a pseudorandom key.
Expand block
T(i) = HMAC(PRK, T(i−1) || info || i)
T(i) = HMAC(PRK, T(i-1) || info || i)Generates each output block from the previous block and context info.
Pseudocode
- 1.Compute extract step with HMAC over input key material
- 2.Initialize an empty output
- 3.Repeatedly HMAC the previous block, info, and counter
- 4.Concatenate blocks and truncate to requested length
Canonical Example
- Input
- input = shared_secret, info = "client key"
- Output
- output = client_write_key
- Explanation
- HKDF extracts entropy, then expands a context-labeled key.
Implementation Notes
- Treat output length limits and hash length as part of the API contract.
- Do not implement production cryptography from scratch; use the entry to understand the mechanism.
- Keep a tiny example with expected output beside the implementation.
Common Pitfalls
- Reusing the same info value for different key purposes weakens separation.
- Confusing hashing, encryption, signing, and key derivation can create insecure designs.
- Not defining boundary, empty, or degenerate inputs before implementation.
Interactive Mechanism Walkthrough
Graph Frontier & Edge RelaxationShow extract producing one pseudorandom key, then expand producing labeled output blocks.
Step 1 of 4: Compute extract step with HMAC over input key material
crypto-flowNotes
The info field is important for separating keys used for different purposes.
Sources (1)
What each reference supports for this entry.
RFC 5869
DocumentationIETF specification for the HMAC-based Extract-and-Expand Key Derivation Function.
Open sourceExplore Next
Good next jumps from the relationship graph, ranked for useful discovery.
Relationships
View full relationship pageOften paired withDiffie-Hellman Key Exchange
HKDF commonly derives keys from Diffie-Hellman shared secrets.
UsesHMAC
HKDF uses HMAC for extract and expand operations.
Related Algorithms
Tags
CryptographyKey DerivationMessage AuthenticationSecurity