KDF based on HMAC-SHA-256

Question

Is KDF based on HMAC-SHA-256(Hashed Message Authentication Code, Secure Hash Algorithm) algorithm a suitable option to generate symmetric key from the secret key?

What is the basic funda, behind using KDF after getting the secret key. Can the secret key itself be used as the symmetric key.

By KDF do you specifically mean HKDF, which you chose as a tag? — otus, Jul 19 '14 at 11:11
I mean Single-step Key-Derivation Function (section 5.8.1 -NIST.SP.800-56Ar2 document) — Kiran, Jul 19 '14 at 11:45
Is HKDF and Single-step Key-Derivation Function using SHA-256 same? — Kiran, Jul 19 '14 at 11:57
See RFC 2898 for KDFs based on cryptographically secure hash algorithms and MACs. — marstato, Jul 19 '14 at 12:03

score 2 · Answer 1 · edited Apr 13 '17 at 12:48

Yes, according to NIST SP 800-56A revision 2, a KDF based on HMAC-SHA-256 is a suitable option.

The basic idea behind using a Key Based Key Derivation Function KBKDF is that the output of the the primitive within the key agreement protocol (DH, ECDH) returns enough entropy for a key to be created. However that entropy may still be distinguishable from random. For instance, the first bit of the secret after a Diffie-Hellman key agreement will certainly be biased. Hence it is required that a KDF extracts the entropy into a key that is indistinguishable from random.

Besides the extraction of the entropy, the KDF may also be used to expand the amount of key material. This key material can be generated by supplying different otherInfo or counter to the KDF (preferred) or by requesting a larger output from the KDF. Note that the entropy within the keys is still bounded by the entropy in the output of the extraction phase or the internal state of the KDF.

The question if the secret can be used as symmetric key directly depends on the key agreement used. I've asked a specific question for Diffie-Hellman here. Note that the KDF calculation should take a small amount of processor time and memory, especially compared to for instance DH or ECDH.

I've removed the language specific part of the answer (edited out from the question by otus). As you ask if a KDF based on HMAC-SHA-256 is identical on multiple platforms, the side question is impossible to answer. Usually crypto algorithms are identical if they 1) are based and tested against standards and 2) they apply the same encoding (if any) to the input and output. — Maarten Bodewes, Jul 20 '14 at 13:27

KDF based on HMAC-SHA-256

1 Answers1