Key derivation

Example

context = "Examples"

master_key = Hydro::Kdf.keygen

subkey1 = Hydro::Kdf.derive_from_key(32, 1, context, master_key);
subkey2 = Hydro::Kdf.derive_from_key(32, 2, context, master_key);
subkey3 = Hydro::Kdf.derive_from_key(64, 3, context, master_key);

Purpose

Multiple secret subkeys can be derived from a single, high-entropy master key.

With the master key and a key identifier, a subkey can be deterministically computed. However, given a subkey, an attacker cannot compute the master key nor any other subkeys.

The Hydro::Kdf API can derive up to 2^64 keys from a single master key and context, and individual subkeys can have an arbitrary length between 128 (16 bytes) and 524,280 bits (65535 bytes).

Usage

key = Hydro::Kdf.keygen

The Hydro::Kdf.keygen() function creates a master key.

subkey = Hydro::Kdf.derive_from_key(subkey_len, subkey_id, ctx, key)

The Hydro::Kdf.derive_from_key() function derives a subkey_id-th subkey subkey of length subkey_len bytes using the master key key and the context ctx.

subkey_id can be any value up to (2^64)-1.

Constants

Hydro::Kdf::CONTEXTBYTES=8
Hydro::Kdf::KEYBYTES=32
Hydro::Kdf::BYTES_MAX=65535
Hydro::Kdf::BYTES_MIN=16

Notes

This function requires a high-entropy master key. It is not suitable for deriving keys from a password.