Salt, defaults and independent inputs
02Salt improves extraction without normally needing secrecy. Its origin and independence matter as well as its bytes.
In this key-exchange example an untrusted nonce has not been authenticated as coming from the legitimate party. The application does not use it as salt.
Source for this drawing: RFC 5869 · Read RFC section 3.1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
- Salt
- An extraction input, usually public, independent of IKM.
- HashLen
- The hash output length in octets; 32 for the chosen SHA-256 example.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Salt is optional. If not provided, extract uses a string of HashLen zero octets, not the text character 0 repeated HashLen times.
- Salt is optional. If not provided, extract uses a string of HashLen zero octets, not the text character 0 repeated HashLen times.
- Ideally salt is random or pseudorandom and HashLen octets long. Shorter or less random salt can still help; the default is supported rather than prohibited.
- Salt normally is non-secret and can be reused. Some applications can use a secret salt; the construction does not forbid that case.
- Security analysis assumes salt independent of IKM and not chosen or manipulated by an attacker. In the RFC’s key-exchange nonce example, authenticate the contributing nonces before using them as salt.
The drawing uses SHA-256 only to make lengths concrete: missing salt means 32 zero bytes. The rejected case concerns an attacker-manipulated nonce in the RFC’s authenticated key-exchange setting; it is not a universal requirement that salt be transmitted or that every protocol use that particular nonce mechanism.
Read the RFC section ↗