HKDF

Why It Matters

For developers working with cryptographic systems, HKDF provides a robust and standardized method for generating keys from potentially weak or non-uniform input. Without proper key derivation, cryptographic systems can be vulnerable to attacks that exploit predictable or low-entropy keys.

In production systems, HKDF ensures that even if a user's password or a shared secret is weak, the derived keys used for encryption or authentication remain strong. This is crucial in environments where key material may be reused across multiple sessions or protocols. HKDF also supports secure key stretching and helps maintain consistency in cryptographic implementations across platforms and languages.

How It Works

HKDF operates in two main phases: extraction and expansion. The extraction phase takes the input key material and produces a pseudorandom key (PRK) using HMAC. The expansion phase takes the PRK and generates one or more output keying material (OKM) of specified length.

• HKDF requires a hash function, typically SHA-256 or SHA-384, as specified by the HMAC algorithm.
• The extraction phase uses an optional salt to add entropy to the input key material.
• Expansion uses an optional info string to provide context for the derived key, such as the purpose or protocol.
• The output length is specified in bytes and determines how much key material is generated.
• HKDF does not require the input key material to be of fixed length or high entropy; it normalizes and strengthens it.

Quick Reference

Basic Example

This example demonstrates the basic HKDF usage with a simple input key and salt. It illustrates how HKDF extracts and expands key material for cryptographic use.

const crypto = require('crypto');

const ikm = Buffer.from('secret_key_material');
const salt = Buffer.from('salt_for_key_derivation');
const info = Buffer.from('key_derivation_context');
const length = 32;

const prk = crypto.createHmac('sha256', salt).update(ikm).digest();
const okm = crypto.createHmac('sha256', prk).update(info).digest();

console.log(okm.toString('hex'));

The example shows HKDF's two-phase process: first, extracting a pseudorandom key using HMAC-SHA256 with the salt and input key material, then expanding it with an info string to generate output key material.

Production Example

In production, HKDF is used in secure protocols such as TLS or session key derivation. This example shows a more complete implementation with error handling, validation, and secure defaults.

const crypto = require('crypto');

function hkdf(ikm, salt, info, length, hash = 'sha256') {
  if (length > 255 * crypto.getHashes().includes(hash) ? 32 : 48) {
    throw new Error('Output length exceeds maximum allowed');
  }

  const prk = crypto.createHmac(hash, salt).update(ikm).digest();
  const okm = [];

  let t = Buffer.alloc(0);
  let blockIndex = 1;

  while (okm.length