all the following discussion is for HKDF in TLS1.3:

  • Regarding the 'salt' parameter in - HKDF-Extract(salt, IKM)

    as written in RFC 5869:

    HKDF without having to protect the secrecy of the salt. In a different application domain, a key agreement protocol deriving
    cryptographic keys from a Diffie-Hellman exchange can derive a salt value from public nonces exchanged and authenticated between
    communicating parties as part of the key agreement (this is the
    approach taken in [IKEv2]).

    From what it seems, the client's random nonce is used for the salt, but I cannot find any documentation about it in the TLS 1.3 RFC, am I correct?

  • And regarding the 'info' paramter in HKDF-Expand(PRK, info, L):

    Is it identical to the 'label' which's used in TLS 1.2 for PRF? Or are there new values for TLS 1.3 when deriving keys?

    I'm just really confused about which parameter should be passed in each stage.

    For example, when deriving the master-secret with the relevant hash, shared-secret, which 'info' parameter should be passed?

Thanks in advance!

  • 1
    $\begingroup$ Can you quote the specific parts of tools.ietf.org/html/rfc8446#section-7.1 that you're unsure about? $\endgroup$ – Squeamish Ossifrage Feb 19 at 17:41
  • $\begingroup$ I wasn't sure why the function is in a different format than the Expand/Extract, is that supposed to be the wrapper for them? $\endgroup$ – Martin Feb 19 at 19:02
  • $\begingroup$ The TLS key schedule is all defined in terms of HKDF-Extract and HKDF-Expand. See the diagram on page 93, with a description of how to interpret it on page 92. $\endgroup$ – Squeamish Ossifrage Feb 19 at 19:04
  • $\begingroup$ Oh! So in that diagram the "derived" input is the 'info' parameter when computing the master-secret? $\endgroup$ – Martin Feb 19 at 19:07
  • $\begingroup$ The master secret is given by HKDF-Extract(salt=Derive-Secret(handshake secret, "derived", ""), ikm=(empty string)), which is, incidentally, the HMAC under key Derive-Secret(handshake secret, "derived", "") of the empty string. $\endgroup$ – Squeamish Ossifrage Feb 19 at 19:11

Your Answer


Browse other questions tagged or ask your own question.