Password hashing / KDF
HKDF
HMAC-based Extract-and-Expand Key Derivation Function, by Hugo Krawczyk (CRYPTO 2010, RFC 5869). HKDF is the modern default fornon-passwordkey derivation: TLS 1.3, Signal, Noise, Tor, QUIC, WireGuard, and libsodium’s kdf module all use it.
At a glance
| Output | Up to 255 · hashLen bytes per call |
|---|---|
| Inputs | input key material (IKM), optional salt, optional “info” context |
| Construction | Extract (HMAC over IKM with salt as key) then Expand (HMAC chain) |
| Internal primitive | HMAC over any cryptographic hash (typically SHA-256 / SHA-512) |
| Standard | RFC 5869 |
| Status | Modern, recommended |
HKDF is NOT for passwords
HKDF runs in microseconds. It assumes the input key material already has high entropy (a Diffie-Hellman shared secret, a random session key). For deriving keys from passwords, use Argon2id, scrypt, or PBKDF2.
The two stages
- Extract:
PRK = HMAC(salt, IKM). Concentrates IKM entropy into a fixed-length PRK. Random salt makes HKDF a strong randomness extractor. - Expand: produce as many output bytes as needed by chaining HMACs. Each block
T(i) = HMAC(PRK, T(i-1) ∥ info ∥ i).
The info field, domain separation
Reusing the same PRK for multiple keys is fine as long as info differs. Always include protocol name, version, and key purpose in info.
Where it is used
- TLS 1.3 , the entire key schedule is HKDF-SHA-256/384.
- Signal protocol , deriving message keys from the ratchet output.
- Noise framework , key derivation in every Noise handshake.
- QUIC , packet protection keys.
- WireGuard , key schedule.
- libsodium ,
crypto_kdfuses HKDF-SHA-512.
References
- RFC 5869 , HKDF
- Krawczyk , Cryptographic Extraction and Key Derivation: The HKDF Scheme (CRYPTO 2010)
- RFC 8446 §7 , TLS 1.3 key schedule using HKDF
Generate
Run hkdf on your input
16 bytes
32
Quick quiz
Test yourself on hkdf
10 multiple-choice questions. Pick an answer for each, then submit to see explanations.
Q1.Designer of HKDF:
Q2.RFC:
Q3.HKDF construction:
Q4.Is HKDF appropriate for passwords?
Q5.What is the info field used for?
Q6.Which protocol's key schedule is HKDF?
Q7.libsodium's crypto_kdf uses:
Q8.Max output of a single HKDF call:
Q9.Extract step:
Q10.Which protocol does NOT use HKDF?