1

Is OK to derive a key using HKDF (Extract & expand) with a shorter size than the digest size of the configured hash function? In that case the result is computed (on the expand part) by truncating HMAC(PRK, "" | info | 0x01) .

If it is not OK, then I am thinking on using a hash function that has a shorter size in order to at least get 2 or 3 HMAC computations more into the final key.

Maarten Bodewes
  • 92,551
  • 13
  • 161
  • 313
carce-bo
  • 195
  • 5

1 Answers1

1

Trimming the result of hashes and key derivation functions are completely normal. We expect each bit to depend on every input bit ( avalanche effect).

There is no danger in the trimming as long as

  1. The trimmed size is not so short that can cause some attacks since the output size determines the upper bound on the security, not preferably less than 256-bit output ( See Removing a byte from SHA-256).
  2. Don't use the same output for different purposes with trimmed and non-trimmed.

  • We have SHA512/256 SHA512/384 as trimming. Keep in mind that they have different initial values to achieve domain separation.

  • Likewise, HKDF is designed in this way, too. On the Expand part $$OKM \gets \text{KDF-Expand}(PRK, info, L),$$ Where $OKM$ is the output key material and $L$ is the desired output size. Even the standard provides the output size.

kelalaka
  • 48,443
  • 11
  • 116
  • 196