IT lexicon Security HKDF

HKDF

Security På svenska → Updated: 2026-05-23

HMAC-based Key Derivation Function (RFC 5869) — takes input keying material and produces an arbitrary number of deterministic, independent keys.

Two phases: extract (compress entropy from IKM into a fixed pseudo-random key with HMAC) and expand (HMAC-loop pseudo-random key + counter + info-tag to produce output). Fast, simple, secure, no fluff.

Not for passwords — there you want PBKDF2/Argon2 (deliberately slow). HKDF is for already-high-entropy keys: TLS 1.3 traffic keys, Signal's Double Ratchet, Noise protocol, age-encryption.

← Back to the lexicon