hkdf

hkdf is the RustCrypto project’s pure-Rust implementation of HKDF (RFC 5869), the HMAC-based Extract-and-Expand Key Derivation Function used to turn non-uniform input key material — such as a Diffie-Hellman shared secret — into one or more cryptographically strong keys. It is generic over any hash function implementing the digest crate traits, works in no_std environments, and exposes both a combined Hkdf::new API and separate extract/expand steps for callers that need access to the intermediate pseudorandom key.

As part of the broader RustCrypto/KDFs workspace, the crate is maintained alongside sibling key-derivation-function crates (ANSI-X9.63-KDF, bake-kdf, Concat-KDF, KBKDF) and shares their testing infrastructure, MSRV policy, and dual Apache-2.0/MIT licensing. It is one of the most widely depended-upon low-level cryptographic crates in the Rust ecosystem, used by TLS, cryptocurrency, and secure-messaging libraries wherever key material needs to be derived deterministically from a shared secret.

What You Get

• A Hkdf<H> type generic over any hash function implementing the digest/hmac traits (SHA-1, SHA-2, SHA-3, BLAKE2, etc.)
• Combined new/expand API for the common case, plus separate extract/from_prk calls for advanced use cases that need the intermediate pseudorandom key
• no_std support with zero required allocation, suitable for embedded and constrained environments
• An optional SimpleHmac-backed variant (SimpleHkdf) for hash functions without a dedicated HMAC optimization
• Test vectors from RFC 5869 and Project Wycheproof exercised in the crate’s own test suite

Common Use Cases

• Deriving symmetric encryption/authentication keys from a Diffie-Hellman shared secret in a handshake protocol
• Expanding a single high-entropy master key into multiple purpose-specific subkeys
• Key derivation steps inside higher-level protocol implementations (TLS 1.3, Noise Protocol, Signal-style ratchets)
• Deterministically generating keys for envelope encryption or key-wrapping schemes

Under The Hood

Architecture hkdf.rs exposes GenericHkdf<H>/GenericHkdfExtract<H> structs generic over an HmacImpl trait (src/hmac_impl.rs), with Hkdf<H>/HkdfExtract<H> as Hmac-backed type aliases and SimpleHkdf<H>/SimpleHkdfExtract<H> as SimpleHmac-backed alternatives for hashes lacking a dedicated HMAC fast path. The public surface in src/lib.rs (177 lines) is intentionally small: new, extract, from_prk, and expand/expand_multi_info, mirroring RFC 5869’s Extract-then-Expand two-step construction while allowing callers to skip the extract step if they already hold a strong PRK. An optional kdf feature implements the generic Kdf trait from the sibling kdf crate so HKDF can be used interchangeably with other KDFs in the workspace. Tech Stack Pure Rust, no_std by default (src/lib.rs #![no_std]), depending only on the hmac crate (itself generic over digest); dev-dependencies pull in sha1/sha2 and the blobby test-vector-parsing crate for RFC 5869/Wycheproof conformance tests. Edition 2024, MSRV 1.85, part of a Cargo workspace shared with four sibling KDF crates (ansi-x963-kdf, bake-kdf, kbkdf, one-step-kdf) under a single top-level Cargo.toml. Code Quality The crate carries an extensive workspace-wide Clippy lint configuration (unsafe_code = "forbid", unwrap_used, missing_docs, cast_* lints all set to warn/forbid), and its tests/ directory runs both the official RFC 5869 test vectors (tests/rfc5869.rs) and Google’s Project Wycheproof vectors (tests/wycheproof.rs) against tests/data, giving strong confidence in cryptographic correctness beyond unit tests alone. Error handling uses explicit typed errors (InvalidLength, InvalidPrkLength in src/errors.rs) rather than panics for user-facing failure modes. API Design The API mirrors RFC 5869’s own extract/expand vocabulary closely, keeping the mental model thin for anyone who has read the spec; Hkdf::new covers the 90% case in one call, while extract/from_prk are opt-in for advanced composition. Minimal external dependencies and no_std support make it a low-friction building block inside other protocol crates rather than a standalone tool.