HKDF

Table of Contents

• Theory
• Module Methods

Theory

HKDF (RFC 5869) is a simple key derivation function based on HMAC. It is often used to derive multiple session keys from a single master secret.

It follows a standard "Extract-then-Expand" paradigm:

1. Extract: Derives a fixed-length pseudorandom key ($PRK$) from the input keying material ($IKM$) and optional salt.
2. Expand: Expands the $PRK$ into multiple cryptographically strong output keys.

Module Methods

hkdfSync(digest, key, salt, info, keylen)

Synchronous HKDF derivation.

import QuickCrypto from 'react-native-quick-crypto';

// Combined Extract + Expand
const derived = QuickCrypto.hkdfSync(
  'sha256',       // Digest
  'ikm-secret',   // Input Key Material
  'salt',         // Salt
  'context-info', // Context Info
  64              // Output length
);

hkdf(digest, key, salt, info, keylen, callback)

hkdfExtractSync(digest, ikm, salt?) / hkdfExtract(digest, ikm, salt, callback)

Runs only the Extract step of RFC 5869, returning the pseudorandom key ($PRK$) as a Buffer of HashLen bytes. Use this when a protocol performs Extract and Expand at different stages (TLS 1.3, Noise, Signal, MLS). salt defaults to a string of HashLen zero bytes when omitted from the sync form; the async form requires salt (the callback takes the trailing argument).

import QuickCrypto from 'react-native-quick-crypto';

const prk = QuickCrypto.hkdfExtractSync('sha256', 'ikm-secret', 'salt');

QuickCrypto.hkdfExtract('sha256', 'ikm-secret', 'salt', (err, prk) => {
  // ...
});

hkdfExpandSync(digest, prk, info, keylen) / hkdfExpand(digest, prk, info, keylen, callback)

Runs only the Expand step, deriving keylen bytes of output keying material from an already-derived prk. prk must be at least HashLen bytes, and keylen must not exceed 255 * HashLen (RFC 5869 §2.3).

import QuickCrypto from 'react-native-quick-crypto';

const okm = QuickCrypto.hkdfExpandSync('sha256', prk, 'context-info', 64);

QuickCrypto.hkdfExpand('sha256', prk, 'context-info', 64, (err, okm) => {
  // ...
});