Derive the key and each nonce
03HKDF, the HMAC-based Extract-and-Expand Key Derivation Function, derives a per-message key and nonce base. Each record combines that base with its own sequence number.
For a hypothetical next record with this same message key, encode sequence 1 as 12 big-endian octets and XOR with the same base. Only the last bit changes in this example. The key stays fixed within this message; nonce progression protects record order.
Source for this drawing: RFC 8188 · Read RFC section 2.2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Extract with SHA-256: PRK = HMAC-SHA-256(salt, IKM), where IKM is separately supplied input-keying material and PRK is a pseudorandom key.
- Extract with SHA-256: PRK = HMAC-SHA-256(salt, IKM), where IKM is separately supplied input-keying material and PRK is a pseudorandom key.
- Expand with different info strings: Content-Encoding: aes128gcm followed by 00 for a 16-octet key; Content-Encoding: nonce followed by 00 for a 12-octet nonce base. A single 01 block counter follows each info value.
- XOR the nonce base with the 96-bit big-endian record sequence number, beginning at zero. XOR combines corresponding bits; it is not integer addition or concatenation.
Published test keys are examples, not secrets to use. This guide does not implement key management or a production cryptographic library.
Read the RFC section ↗