Package org.conscrypt

Class Hkdf

java.lang.Object
org.conscrypt.Hkdf
public final class Hkdf extends Object
Hkdf - perform HKDF key derivation operations per RFC 5869.

Instances should be instantiated using the standard JCA name for the required HMAC.

Each invocation of expand or extract uses a new Mac instance and so instances of Hkdf are thread-safe.

  • Constructor Summary

    Constructors
    Constructor
    Description
    Hkdf(String hmacName)
    Creates an Hkdf instance which will use hmacName as the name for the underlying HMAC algorithm, which will be located using normal JCA precedence rules.

  • Method Summary

    Modifier and Type
    Method
    Description
    byte[]
    expand(byte[] prk, byte[] info, int length)
    Performs an HKDF expand operation as specified in RFC 5869.
    byte[]
    extract(byte[] salt, byte[] ikm)
    Performs an HKDF extract operation as specified in RFC 5869.
    int
    getMacLength()
     

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • Hkdf

      public Hkdf(String hmacName) throws NoSuchAlgorithmException
      Creates an Hkdf instance which will use hmacName as the name for the underlying HMAC algorithm, which will be located using normal JCA precedence rules.

      Parameters:
      hmacName - the name of the HMAC algorithm to use
      Throws:
      NoSuchAlgorithmException - if hmacName is not a valid HMAC name

  • Method Details

    • getMacLength

      public int getMacLength()

    • extract

      public byte[] extract(byte[] salt, byte[] ikm) throws InvalidKeyException, NoSuchAlgorithmException
      Performs an HKDF extract operation as specified in RFC 5869.
      Parameters:
      salt - the salt to use
      ikm - initial keying material
      Returns:
      a pseudorandom key suitable for use in expand operations
      Throws:
      InvalidKeyException - if the salt is not suitable for use as an HMAC key
      NoSuchAlgorithmException - if the Mac algorithm is no longer available

    • expand

      public byte[] expand(byte[] prk, byte[] info, int length) throws InvalidKeyException, NoSuchAlgorithmException
      Performs an HKDF expand operation as specified in RFC 5869.
      Parameters:
      prk - a pseudorandom key of at least HashLen octets, usually the output from the extract step. Where HashLen is the key size of the underlying Mac
      info - optional context and application specific information, can be zero length
      length - length of output keying material in bytes (invalid input: '<'= 255*HashLen)
      Returns:
      output of keying material of length bytes
      Throws:
      InvalidKeyException - if prk is not suitable for use as an HMAC key
      IllegalArgumentException - if length is out of the allowed range
      NoSuchAlgorithmException - if the Mac algorithm is no longer available