RFC 5869 / START HERE
HKDF, before the details
HMAC-based Extract-and-Expand Key Derivation Function (HKDF). HMAC is a keyed message-authentication function built from a hash.
HKDF derives key material from an existing source of key material. Extract makes a fixed-length pseudorandom intermediate key; expand uses that key and context information to produce the requested number of output bytes.
The idea in one picture
Input keying material
Extract intermediate key
Expand for the context
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
RFC 5869 documents a reusable two-stage construction and how to choose salt, context and lengths. It is Informational, not an Internet Standards Track publication, and does not replace or update another RFC. It helps distinguish key derivation from encryption, random-number generation and password hardening.
A familiar example
A fictional protocol starts with shared secret material and derives separate keys for sending and receiving by choosing distinct context labels. The guide uses public SHA-256 test values, never real keys. Expanding to more bytes cannot create new input entropy or make a predictable password hard to guess.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Extract first, then expandHKDF turns input keying material into a pseudorandom key, then derives the requested output material from that key.→
- Salt, defaults and independent inputsSalt improves extraction without normally needing secrecy. Its origin and independence matter as well as its bytes.→
- Chain expansion blocks with a byte counterExpand repeatedly applies HMAC with the same PRK key, the previous block, the context info and a one-octet counter.→
- Choose a length and truncate the streamExpand returns exactly L bytes by taking a prefix of its block stream. The counter limits the maximum amount from one call.→
- Reproduce the official SHA-256 vectorA public test vector lets you check exact input roles, encoding, intermediate key and final output without using real secrets.→
- Context separation and security limitsinfo binds derived material to its use, but the consuming protocol still needs sound input entropy and a clear key-derivation design.→
This introduction explains RFC 5869 (2010). Read the original RFC ↗