@panva/hkdf

What is @panva/hkdf?

@panva/hkdf is a Node.js implementation of the HMAC-based Extract-and-Expand Key Derivation Function (HKDF) as described in RFC 5869. It is used to derive one or more keys from a single secret key, which is useful in cryptographic applications.

What are @panva/hkdf's main functionalities?

Key Derivation

This feature allows you to derive a key from initial key material (ikm), a salt, and optional context information (info). The derived key length and hash algorithm can be specified.

const { hkdf } = require('@panva/hkdf');

async function deriveKey() {
  const ikm = Buffer.from('initial key material');
  const salt = Buffer.from('salt');
  const info = Buffer.from('info');
  const length = 32; // length of the derived key in bytes
  const hash = 'SHA-256';

  const derivedKey = await hkdf(hash, ikm, salt, info, length);
  console.log(derivedKey.toString('hex'));
}

deriveKey();

Other packages similar to @panva/hkdf

futoin-hkdf

futoin-hkdf is another implementation of the HKDF algorithm in Node.js. It provides similar functionality to @panva/hkdf, allowing for key derivation using the HKDF algorithm. The main difference is in the API design and additional features like support for different hash algorithms.

crypto

The built-in 'crypto' module in Node.js also provides an implementation of HKDF starting from Node.js v15.0.0. It offers a more integrated approach since it is part of the standard library, but it may not be available in older Node.js versions.

README

hkdf

HKDF with no dependencies using runtime's native crypto

HKDF is a simple key derivation function defined in RFC 5869.

Documentation

▸ hkdf(digest, ikm, salt, info, keylen): Promise<Uint8Array>

The given ikm, salt and info are used with the digest to derive a key of keylen bytes.

Parameters

Name	Type	Description
digest	"sha256" | "sha384" | "sha512" | "sha1"	The digest algorithm to use.
ikm	Uint8Array | string	The input keying material. It must be at least one byte in length.
salt	Uint8Array | string	The salt value. Must be provided but can be zero-length.
info	Uint8Array | string	Additional info value. Must be provided but can be zero-length, and cannot be more than 1024 bytes.
keylen	number	The length in bytes of the key to generate. Must be greater than 0 and no more than 255 times the digest size.

Returns

Promise<Uint8Array>

Example

example ESM import

import hkdf from '@panva/hkdf'

example CJS import

const { hkdf } = require('@panva/hkdf')

example Deno import

import hkdf from 'https://deno.land/x/hkdf/index.ts'

example Usage

const derivedKey = await hkdf(
  'sha256',
  'key',
  'salt',
  'info',
  64
)

Supported Runtimes

The supported JavaScript runtimes include ones that

• are reasonably up to date ECMAScript
• support the utilized Web API globals and standard built-in objects
• These are
  • (This is not an exhaustive list)
  • Browsers
  • Cloudflare Workers
  • Deno
  • Electron
  • Netlify Edge Functions
  • Next.js Middlewares
  • Node.js
  • Vercel Edge Functions

Changelog

1.1.0 (2023-04-26)

Features

• release process with provenance (0ca439c)