RFC 5869: HMAC-based Extract-and-Expand Key Derivation Function (HKDF)

This document specifies a simple Hashed Message Authentication Code (HMAC)-based key derivation function (HKDF), which can be used as a building block in…

Read RFC 5869 on the RFC Editor

Outgoing relationships (5 related RFCs)

Normative reference — RFC 2104: HMAC: Keyed-Hashing for Message Authentication
Informative reference — RFC 4306: Internet Key Exchange (IKEv2) Protocol
Informative reference — RFC 2898: PKCS #5: Password-Based Cryptography Specification Version 2.0
Informative reference — RFC 5191: Protocol for Carrying Authentication for Network Access (PANA)
Informative reference — RFC 5448: Improved Extensible Authentication Protocol Method for 3rd Generation Authentication and Key Agreement (EAP-AKA')

Incoming relationships (35 related RFCs)

Normatively referenced by — RFC 6234: US Secure Hash Algorithms (SHA and SHA-based HMAC and HKDF)
Normatively referenced by — RFC 8152: CBOR Object Signing and Encryption (COSE)
Normatively referenced by — RFC 9053: CBOR Object Signing and Encryption (COSE): Initial Algorithms
Normatively referenced by — RFC 8915: Network Time Security for the Network Time Protocol
Normatively referenced by — RFC 9301: Locator/ID Separation Protocol (LISP) Control Plane
Normatively referenced by — RFC 8937: Randomness Improvements for Security Protocols
Normatively referenced by — RFC 9258: Importing External Pre-Shared Keys (PSKs) for TLS 1.3
Normatively referenced by — RFC 9528: Ephemeral Diffie-Hellman Over COSE (EDHOC)
Normatively referenced by — RFC 8418: Use of the Elliptic Curve Diffie-Hellman Key Agreement Algorithm with X25519 and X448 in the Cryptographic Message Syntax (CMS)
Normatively referenced by — RFC 7978: Transparent Interconnection of Lots of Links (TRILL): RBridge Channel Header Extension
Normatively referenced by — RFC 8188: Encrypted Content-Encoding for HTTP
Normatively referenced by — RFC 9203: The Object Security for Constrained RESTful Environments (OSCORE) Profile of the Authentication and Authorization for Constrained Environments (ACE) Framework
Normatively referenced by — RFC 9303: Locator/ID Separation Protocol Security (LISP-SEC)
Normatively referenced by — RFC 9231: Additional XML Security Uniform Resource Identifiers (URIs)
Normatively referenced by — RFC 9936: Use of ML-KEM in the Cryptographic Message Syntax (CMS)
Normatively referenced by — RFC 8291: Message Encryption for Web Push
Normatively referenced by — RFC 9382: SPAKE2, a Password-Authenticated Key Exchange
Normatively referenced by — RFC 9383: SPAKE2+, an Augmented Password-Authenticated Key Exchange (PAKE) Protocol
Normatively referenced by — RFC 9498: The GNU Name System
Normatively referenced by — RFC 9605: Secure Frame (SFrame): Lightweight Authenticated Encryption for Real-Time Media
Normatively referenced by — RFC 9688: Use of the SHA3 One-Way Hash Functions in the Cryptographic Message Syntax (CMS)
Normatively referenced by — RFC 9709: Encryption Key Derivation in the Cryptographic Message Syntax (CMS) Using HKDF with SHA-256
Informatively referenced by — RFC 7401: Host Identity Protocol Version 2 (HIPv2)
Informatively referenced by — RFC 6189: ZRTP: Media Path Key Agreement for Unicast Secure RTP
Informatively referenced by — RFC 9629: Using Key Encapsulation Mechanism (KEM) Algorithms in the Cryptographic Message Syntax (CMS)
Informatively referenced by — RFC 9380: Hashing to Elliptic Curves
Informatively referenced by — RFC 9580: OpenPGP
Informatively referenced by — RFC 9202: Datagram Transport Layer Security (DTLS) Profile for Authentication and Authorization for Constrained Environments (ACE)
Informatively referenced by — RFC 6476: Using Message Authentication Code (MAC) Encryption in the Cryptographic Message Syntax (CMS)
Informatively referenced by — RFC 6617: Secure Pre-Shared Key (PSK) Authentication for the Internet Key Exchange Protocol (IKE)
Informatively referenced by — RFC 8696: Using Pre-Shared Key (PSK) in the Cryptographic Message Syntax (CMS)
Informatively referenced by — RFC 9807: The OPAQUE Augmented Password-Authenticated Key Exchange (aPAKE) Protocol
Informatively referenced by — RFC 9820: Authentication Service Based on the Extensible Authentication Protocol (EAP) for Use with the Constrained Application Protocol (CoAP)
Informatively referenced by — RFC 9949: BUSA-TLS: Mandatory Audio Component (MAC) Pre-Shared Key (PSK) Derivation for TLS 1.3 Using 2 Live Crew's "Banned in the U.S.A."
Informatively referenced by — RFC 10024: Post-Quantum Traditional (PQ/T) Hybrid Key Agreement Mechanisms for TLS 1.3