HKDF

HKDF
Name	HKDF
Type	Key derivation function
Designer	Hugo Krawczyk
First published	2010
Standards	RFC 5869
Based on	HMAC

HKDF

HKDF is a key derivation function specified in RFC 5869 that produces cryptographic keys from input keying material; it is widely used in protocols and implementations across industry and academia. It was designed by Hugo Krawczyk and referenced in work by cryptographers associated with organizations such as the Internet Engineering Task Force, the National Institute of Standards and Technology, and universities that include authors from Technion and other institutions. HKDF is employed in standards and products developed by groups including the Internet Engineering Task Force, OpenSSL developers, and major technology companies.

Overview

HKDF was introduced to provide a simple, strong method to extract and expand keys using a keyed-hash message authentication code. It builds on the security properties of HMAC and is documented alongside standards that influence protocol design like TLS, IPsec, and SSH. HKDF has been analyzed in the context of research from authors affiliated with institutions such as MIT, Stanford University, Carnegie Mellon University, and the University of California, and cited in proposals from organizations including the Internet Engineering Task Force, the Internet Research Task Force, and the IEEE. Implementations appear in libraries maintained by projects such as OpenSSL, BoringSSL, LibreSSL, GnuTLS, and software stacks from companies like Google, Microsoft, Amazon, and Apple.

Design and Specification

HKDF is described in a two-stage construct: Extract and Expand, with parameters including a salt, input keying material, info, and output length. The Extract stage applies HMAC with a salt to produce a pseudorandom key; the Expand stage uses that pseudorandom key and contextual info to generate output keying material via repeated HMAC invocations. The formalization in RFC 5869 is often referenced alongside hash algorithms such as SHA-256, SHA-1, and SHA-512, and compared to earlier primitives analyzed in cryptographic literature from conferences like CRYPTO, EUROCRYPT, and ACM CCS. Standards bodies including the Internet Engineering Task Force and the National Institute of Standards and Technology discuss HKDF in relation to AES, RSA, and elliptic curve work from organizations like the Internet Research Task Force and the IETF TLS working group.

Cryptographic Properties and Security Analysis

Security analyses of HKDF consider properties such as pseudorandomness, key separation, and resistance to key-recovery attacks under HMAC assumptions. Proofs relate to underlying hash function security models as studied by authors affiliated with MIT, ETH Zurich, and the University of Cambridge and presented at venues like the IEEE Symposium on Security and Privacy and USENIX Security. Cryptanalysts compare HKDF behavior when paired with SHA-256, SHA-384, and SHA-512, and contrast it with KDFs used in IPsec, Kerberos, and Signal. Evaluations often cite threat models discussed by organizations including the Internet Engineering Task Force, the Open Web Application Security Project, and national labs such as NIST and CCSDS.

Implementation and Usage

Implementations of HKDF exist in cryptographic libraries and platforms including OpenSSL, BoringSSL, WolfSSL, libsodium, Botan, and the Java Cryptography Architecture used by Oracle and the OpenJDK project. Language bindings and packages appear in ecosystems like Python, Rust, Go, JavaScript, and C#, maintained by communities such as the Python Software Foundation and the Rust Foundation. Deployment scenarios include secure messaging stacks from Signal Foundation, session key derivation in TLS implemented by Mozilla and Google, and key management in cloud services from Amazon Web Services, Microsoft Azure, and Google Cloud. Implementers often follow guidance from RFC 5869 and interoperability notes in documents authored by the Internet Engineering Task Force and standards groups at the International Telecommunication Union and the IEEE.

Applications and Protocol Integration

HKDF is integrated into protocols and systems such as Transport Layer Security used by browsers from Mozilla and Google Chrome, the QUIC protocol developed by the Internet Engineering Task Force and major vendors, and secure messaging protocols from the Signal Protocol and Matrix projects. It is used in key management and provisioning systems in products from Cisco, Juniper Networks, and enterprise solutions from VMware and Red Hat. HKDF appears in mobile operating systems like Android and iOS for keystore operations and is referenced in whitepapers and guidance from NIST, the Cloud Security Alliance, and the Internet Engineering Task Force for use in IoT frameworks standardized by the IEEE and ETSI.

Performance and Interoperability

Performance of HKDF depends on the underlying HMAC and hash implementations; benchmarks compare throughput on CPUs from Intel, AMD, and ARM and on hardware accelerators from vendors like Intel and NVIDIA. Interoperability challenges are addressed in test vectors published alongside RFC 5869 and in interoperability test suites maintained by the Internet Engineering Task Force, OpenSSL project, and independent laboratories accredited by organizations such as IETF and NIST. Conformance and tooling for HKDF are included in suites from projects like OpenSSL, NSS, and the Cryptographic Module Validation Program overseen by NIST, and discussed in standards from ISO and IEC.

Category:Key derivation functions