Skip to content
hashkey.bond

Archivecryptography

HKDF: Turning One Secret Into Many Keys

Extract-then-expand is the standard way to derive purpose-bound keys from shared secrets. Skip it and you invite cross-protocol attacks.

Published
Reading time
1 min read

HKDF is two steps: extract a pseudorandom key from input keying material, then expand it into as many labeled keys as you need.

PRK = HMAC-SHA256(salt, IKM)
OKM = HMAC(PRK, info || counter) repeated

The info string is domain separation. Different purposes must produce different keys, so a key leaked from one protocol cannot decrypt another.

Why not just hash the secret

Raw SHA-256(shared_secret) fails when the secret has low entropy or structure — ECDH outputs are not uniformly random in all representations. Extraction with a salt smooths that. It also gives you a place to bind context:

info = "myapp v2 session key" || transcript_hash

Binding the handshake transcript means a derived key cannot be replayed into a different session.

Mistakes

  • Reusing one derived key for encryption and MAC.
  • Omitting info and relying on "it works".
  • Using HKDF to stretch a password — that needs Argon2/scrypt, not HKDF.

Takeaway: one secret in, many labeled keys out. If two subsystems share a key, they share a compromise.