1

On the wiki page for HKDF, in the Python Implementation, there is a hash_length variable for the sha256 digest length, used in the hmac in the hmac_sha256 function.

However, if I wanted to replace the hmac with a kmac, I would have to change the hmac(...) into kmac(...), where the underlying hash algorithm is the shake256 algorithm (XOF) - with variable output length.

So my question is what is the recommended length to set the shake256 digest size to when incorporating it into a KMAC based HKDF?

SamG101
  • 633
  • 4
  • 12

1 Answers1

3

HKDF already has expansion on top of the MAC that it is based on. What would be the point of using a XOF for that? Why not use the XOF directly or define a different KDF? Because having two different methods for expanding the output seems troublesome to me.

If you're going to use HKDF then use one of the normal SHA-3 / HMAC functions with it. Sure, that's less than optimal, but commonly that's not a huge issue for deriving a limited amount of key material anyway.

Any form of HKDF that redefines the PRF used to derive the key material will not be compatible with anything out there. That's true regardless of the XOF and KMAC standardization.

Maarten Bodewes
  • 96,351
  • 14
  • 169
  • 323