1

I got a question with the RFC of HKDF https://www.rfc-editor.org/rfc/rfc5869.

There is a maximum specified for the output keying material. The length of the OKM shall be <= 255HashLen. What does it mean? For example there is a hashfunction with output of 32 byte. Is my maximum OKM then 25532 = 8160 Byte? Or does it mean, my maximum repetition in the loop is smaller or equal than 8160? So that would mean, that you can generate 8160 (rounds) * 32 (per round output) 261120 Byte output.

I am a little bit confused...thanks for help.

Community
  • 1
chris000r
  • 519
  • 3
  • 15

1 Answers1

3

The former. Maximum output must be <= 255*HashLen. So for SHA256 which has a digest of 32 bytes, max HKDF output would be <= 8160 bytes. For SHA512 which has a digest of 64 bytes, max output must be <= 16320 bytes. I can't imagine you would need a key longer than 8160 bytes. If you require multiple keys you can use the 'info' parameter for different contexts/keys from the same PRK.

hunter
  • 3,965
  • 6
  • 28
  • 42
  • 2
    That last sentence scored an instant +1 from my side. I would also use a specific info parameter for an for a deterministic IV, in case one needs to be derived from the master key material. Note that e.g. in hardware tokens you often need to explicitly derive each key. In software you can just split a byte string, but try to do the same in a Cryptoki (PKCS#11) implementation and you'll run into problems. – Maarten Bodewes Nov 23 '16 at 15:26