Client and backend. This class is shared: the same code is compiled into your app and into your server, so everything on this page works in both.

public final class Hkdf

Object
Hkdf

HMAC-based key derivation (HKDF), per RFC 5869.

HKDF turns input keying material that is not uniformly random – the shared secret of a KeyAgreement, say – into one or more keys of any length. It runs in two steps: extract concentrates the input into a pseudorandom key, and expand stretches that into as many bytes as are asked for, bound to an info label so that keys derived for different purposes never coincide.

KeyPair mine = KeyGenerator.ec(256);
KeyPair theirs = KeyGenerator.ec(256);
byte[] shared = KeyAgreement.ecdh(mine.getPrivateKey(), theirs.getPublicKey());
byte[] keys = Hkdf.derive("SHA-256", null, shared, "chat keys".getBytes(), 64);

It is pure Java over Hmac, so it behaves identically on every port and on the server.

Methods

`public static byte[] extract(String algorithm, byte[] salt, byte[] ikm)`	The extract step: `HMAC(salt, ikm)`.
`public static byte[] expand(String algorithm, byte[] prk, byte[] info, int length)`	The expand step: derives `length` bytes from a pseudorandom key.
`public static byte[] derive(String algorithm, byte[] salt, byte[] ikm, byte[] info, int length)`	Extract then expand in one call.

Inherited methods

From Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait, clone, finalize

Method details

extract

public static byte[] extract(String algorithm, byte[] salt, byte[] ikm)

The extract step: HMAC(salt, ikm). A null or empty salt is replaced by a string of zero bytes the length of the hash, as the RFC specifies.

Parameters

algorithm String: the hash, any name [Hmac#create(String, byte[])] accepts
salt byte[]: optional salt
ikm byte[]: the input keying material

expand

public static byte[] expand(String algorithm, byte[] prk, byte[] info, int length)

The expand step: derives length bytes from a pseudorandom key.

Parameters

algorithm String: the hash
prk byte[]: the pseudorandom key, usually the result of extract
info byte[]: context label; may be null
length int: bytes wanted, at most 255 times the hash length

derive

public static byte[] derive(String algorithm, byte[] salt, byte[] ikm, byte[] info, int length)

Extract then expand in one call.

Parameters

algorithm String: the hash, for example "SHA-256"
salt byte[]: optional salt
ikm byte[]: the input keying material
info byte[]: context label; may be null
length int: bytes wanted