Security News
tea.xyz Spam Plagues npm and RubyGems Package Registries
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
futoin-hkdf
Advanced tools
Readme
Node.js implementation of RFC5869: HMAC-based Extract-and-Expand Key Derivation Function (HKDF).
Additionally, it supports a HKDF-Expand-Label
variation based on RFC8446: The Transport Layer Security (TLS) Protocol Version 1.3, section 7.1. Key Schedule.
The implementation is fully compliant with test vectors provided in the RFC.
There are alternative modules, but they are:
Standalone HKDF extract()
and expand()
actions are also available for advanced usage.
Documentation --> FutoIn™ Guide
Author: Andrey Galkin
The figures in "derived keys per second".
node-hdkf
/hdkf
modules - 57 707 (~22% slower)
ctrlpanel-hdkf
- 52 181 (~30% slower)
@stablelib/hkdf
- 39 808 (~46% slower)
Command line:
$ npm install futoin-hkdf --save
or:
$ yarn add futoin-hkdf --save
const hkdf = require('futoin-hkdf');
// Parameter overview
//-------------------
// initial keying material
const ikm = 'string-or-buffer';
// required output length in bytes
const length = 16;
// can be empty string or false equivalent
const salt = 'strongly-encouraged';
// optional parameter
const info = 'optional-context';
// HMAC hashing algorithm to use
const hash = 'SHA-256';
// Generic derivation
//-------------------
hkdf(ikm, length, {salt, info, hash}); // Buffer(length) - derived key
hkdf(ikm, length, {salt, info, hash}).toString('hex'); // String(2*length)
// NOTE: all optional paramaters are passed in object
// With some parameters omitted
//-------------------
hkdf(ikm, length, {salt});
hkdf(ikm, length, {info});
hkdf(ikm, length, {hash});
hkdf(ikm, length);
// Advanced usage (only if you know what you are doing)
//-------------------
// As in underlying Node.js crypto library
const lhash = hash.toLowerCase().replace( '-', '' ); // 'sha256'
hkdf.hash_length(lhash); // get hash_len
hkdf.extract(lhash, hash_len, ikm, salt); // run only step #1
hkdf.expand(lhash, hash_len, prk, length, info); // run only step #2
// TLS v1.3+
//-------------------
const hkdf_tls = require('futoin-hkdf/tls');
const label = 'tls13 ...';
const context = Buffer.from( /* E.g some binary hash generation */ '' );
hkdf_tls(ikm, length, {salt, label, context, hash}); // Buffer(length) - derived key
// Advanced usage
hkdf_tls.expand_label(lhash, hash_len, prk, length, label, context);
// Same as:
hkdf.expand(lhash, hash_len, prk, length, hkdf_tls.info(length, label, context));
Buffer
HMAC-based Extract-and-Expand Key Derivation Function (HKDF)
Buffer
TLS v1.3 HKDF-extract + HKFD-Expand-Label action
Buffer
HMAC-based Extract-and-Expand Key Derivation Function (HKDF)
Kind: global function
Returns: Buffer
- Raw buffer with derived key of @p length bytes
Param | Type | Default | Description |
---|---|---|---|
ikm | Buffer | string | Initial Keying Material | |
length | integer | Required byte length of output | |
salt | Buffer | string | '' | Optional salt (recommended) |
info | Buffer | string | '' | Optional context (safe to skip) |
hash | string | "'SHA-256'" | HMAC hash function to use |
Buffer
integer
Buffer
Buffer
integer
Get expected hash length.
Kind: static method of hkdf
Returns: integer
- hash digest byte length
Note: Values are hardcoded with fallback for unknown algorithms.
Param | Type | Description |
---|---|---|
hash | string | Hash algorithm (as in underlying Node.js crypto library) |
Buffer
HKDF extract action.
Kind: static method of hkdf
Returns: Buffer
- A buffer with pseudorandom key
Note: Values are hardcoded with fallback for unknown algorithms.
Param | Type | Description |
---|---|---|
hash | string | Hash algorithm (as in underlying Node.js crypto library) |
hash_len | integer | Hash digest length |
ikm | Buffer | string | Initial Keying Material |
salt | Buffer | string | Optional salt (recommended) |
Buffer
HKDF expand action.
Kind: static method of hkdf
Returns: Buffer
- A buffer with output keying material
Note: Values are hardcoded with fallback for unknown algorithms.
Param | Type | Description |
---|---|---|
hash | string | Hash algorithm (as in underlying Node.js crypto library) |
hash_len | integer | Hash digest length |
prk | Buffer | string | A buffer with pseudorandom key |
length | integer | length of output keying material in octets |
info | Buffer | string | Optional context (safe to skip) |
Buffer
TLS v1.3 HKDF-extract + HKFD-Expand-Label action
Kind: global function
Returns: Buffer
- Raw buffer with derived key of @p length bytes
Note: label and context are limited to 255 bytes!
Param | Type | Default | Description |
---|---|---|---|
ikm | Buffer | string | Initial Keying Material | |
length | integer | Required byte length of output | |
salt | Buffer | string | '' | Optional salt (required by fact) |
label | Buffer | string | '' | Optional label (required by fact) |
info | Buffer | string | '' | Optional context (safe to skip) |
hash | string | "'SHA-256'" | HMAC hash function to use |
Buffer
Encode HKDF context parameter in TLS v1.3 style based on RFC8446 TLS v1.3.
Kind: static method of tls
Returns: Buffer
- A buffer with encoded HKDF context
Note: label and context are limited to 255 bytes!
Param | Type | Description |
---|---|---|
length | integer | length of output keying material in octets |
label | string | ASCII label |
context | Buffer | string | Binary context or empty string |
Buffer
TLS-HKDF expand label action - a HKDF-Expand-Label variation based on RFC8446 TLS v1.3.
Kind: static method of tls
Returns: Buffer
- A buffer with output keying material
Note: label and context are limited to 255 bytes!
Param | Type | Description |
---|---|---|
hash | string | Hash algorithm (as in underlying Node.js crypto library) |
hash_len | integer | Hash digest length |
prk | Buffer | string | A buffer with pseudorandom key |
length | integer | length of output keying material in octets |
label | string | ASCII label |
context | Buffer | string | Binary context or empty string |
FAQs
RFC5869: HMAC-based Extract-and-Expand Key Derivation Function (HKDF)
The npm package futoin-hkdf receives a total of 303,752 weekly downloads. As such, futoin-hkdf popularity was classified as popular.
We found that futoin-hkdf demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Security News
As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabilities at scale.
Security News
UnitedHealth Group disclosed that the ransomware attack on Change Healthcare compromised protected health information for millions in the U.S., with estimated costs to the company expected to reach $1 billion.