RFC 5869:

Thus, the goal of the "extract" stage is to "concentrate" the possibly dispersed entropy of the input keying material into a short, but cryptographically strong, pseudorandom key.

The implementation:

HKDF-Extract(salt, IKM) -> PRK

PRK = HMAC-Hash(salt, IKM)

Here salt may be 0. In this case, it feeds IKM into HMAC with a fixed key:

PRK = H(opad || H(ipad || IKM))

How to envision this as a concentration of entropy? How is this different than simply hash the IKM:



  • $\begingroup$ It's not, really, but people seem to like HMAC. Perhaps a clearer choice would be BLAKE2b(salt=salt, message=IKM). $\endgroup$ – Squeamish Ossifrage Jul 14 '18 at 15:25

Your Answer


Browse other questions tagged or ask your own question.