RFC 5869

HMAC-based Extract-and-Expand Key Derivation Function (HKDF)
Informational
May 2010
RFC Library > Crypto Primitives > RFC 5869
Abstract: HKDF is a key derivation function based on HMAC. It extracts a pseudorandom key from input keying material and expands it into multiple cryptographically strong output keys. HKDF is fundamental to 3GPP 5G key hierarchy (TS 33.501) and TLS 1.3.
Canonical source: https://www.rfc-editor.org/rfc/rfc5869  |  IETF Datatracker

1. Introduction

▶

HKDF provides a standard, provably-secure method for deriving one or more cryptographic keys from source keying material. It uses a two-stage approach: Extract (concentrate entropy) and Expand (generate output keys).

In 3GPP 5G (TS 33.501), HKDF-SHA-256 is used to derive the entire 5G key hierarchy: KAUSF from CK'/IK' (AUSF key), KSEAF (SEAF key), KAMF (AMF key), KNASint, KNASenc, KgNB, and subsequent keys. TLS 1.3 also uses HKDF for all key derivation.

2. HKDF Algorithm

▶

Extract: PRK = HMAC-Hash(salt, IKM) — concentrates entropy from IKM into a fixed-length PRK.

Expand: OKM = T(1) || T(2) || ... where T(i) = HMAC-Hash(PRK, T(i-1) || info || i) — generates arbitrary-length output keying material. The 'info' parameter provides context separation.

  Input Keying Material (IKM)     Salt (optional)
|                            |
+------------+---------------+
|
HKDF-Extract (HMAC)
|
v
PRK (Pseudorandom Key)
|
+------------+------------+
|            |            |
HKDF-Expand  HKDF-Expand  HKDF-Expand
(info="key1") (info="key2") (info="key3")
|            |            |
v            v            v
OKM-1        OKM-2        OKM-3
(Output Key)  (Output Key)  (Output Key)

3. 5G Key Derivation (TS 33.501)

▶ 
  K (USIM)         RAND
|               |
+--- AKA ---+---+
|           |   |
CK'         IK'  |
|           |   |
+----+------+   |
|          |
HKDF-Extract     |
|          |
v          |
KAUSF --------+
|
HKDF-Expand (FC=0x6C, SN)
|
v
KSEAF
|
HKDF-Expand (FC=0x6D, SUPI)
|
v
KAMF
/ | \
/  |  \
KNASint KNASenc  KgNB
(HKDF-Expand with algorithm distinguishers)

4. Security Considerations

▶
  • Salt improves extraction when IKM is not uniformly random — always use salt when available
  • The 'info' parameter MUST include context to separate keys for different purposes
  • HKDF output length must not exceed 255 * HashLen — typically not a practical limit
  • Source keying material must have sufficient min-entropy — HKDF cannot amplify entropy