MAC, KDF & password hashingRecommended
HMAC-based Key Derivation Function
Key derivation from high-entropy secrets
How it works
HKDF works in two steps: extract concentrates the entropy of an input secret (such as a Diffie-Hellman shared secret) into a fixed-length key, and expand stretches that key into as many independent keys as needed. It is the basis of the TLS 1.3 key schedule.
Sizes: Output length chosen by the caller, up to 255 times the hash length
Status: For keys and shared secrets, not for passwords.
Strengths
- Simple, well-analysed construction built on HMAC
- Derives multiple separate keys from one secret using context labels
Weaknesses and known attacks
- Fast by design, so it gives no protection to low-entropy inputs such as passwords
Use it for
- Turning a key-exchange output into session keys
- Deriving per-purpose keys from a master key
Don't use it for
- Password hashing or password-based keys (use Argon2id, scrypt, bcrypt or PBKDF2)
Exam tip
Not all KDFs are for passwords. HKDF is for already-strong secrets; key stretching functions are for weak human passwords.