Bind the shared secret to this subscription
03The first HMAC-based Key Derivation Function (HKDF) stage combines the ECDH result with the subscription authentication secret and an ordered context.
HKDF-Expand takes PRK_key and that context with internal counter 0x01 and returns 32 bytes. This IKM feeds the separate RFC 8188 key schedule; it is not transmitted in the body header.
Source for this drawing: RFC 8291 · Read RFC section 3.3 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
The authentication secret and the later public message salt have different roles.
- HKDF uses SHA-256 here. Extract uses the 16-byte authentication secret as salt and the ECDH shared secret as input keying material, producing the pseudorandom key PRK_key.
- key_info is the 13 ASCII bytes WebPush: info, one zero byte, then the receiver public key, then the sender public key. Both points use the 65-byte uncompressed form; the complete context is 144 bytes.
- HKDF-Expand produces 32 bytes of input keying material (IKM) for RFC 8188. Its single HMAC block uses key_info followed by counter byte 0x01.
- The order is user-agent public key before application-server public key. The counter byte is part of HKDF’s calculation, not an extra transmitted field or a terminator to add to the public keys.
The diagrams use the published Appendix A intermediate values. Reversing the two public keys changes the derived material; regression tests check this failure with real authenticated decryption. The displayed fixed values are public RFC test data, not keys to reuse for real messages. These illustrations do not send notifications or implement a production encryptor.
Read the RFC section ↗