IT lexicon › Security › HKDF-Expand-Label

HKDF-Expand-Label

Security På svenska → Updated: 2026-10-14

The thin wrapper around HKDF-Expand that TLS 1.3 uses to derive every individual key, IV and secret.

RFC 8446 (2018) defines it as HKDF-Expand with a structured info parameter: the desired length, a label prefixed with "tls13 ", and a context value, usually a hash of the handshake transcript. Labels are terse strings such as "c hs traffic", "key", "iv" and "finished". Every use gets its own label, so two keys drawn from the same secret can never collide by accident.

It reads like bureaucracy, and that is the point. The older TLS PRF churned out one block of key material that was then sliced into pieces, which made analysis awkward. QUIC borrowed the function wholesale, with labels like "quic key" and "quic hp".

← Back to the lexicon