Package io.github.mahmoudimus.quic

Class Hkdf

java.lang.Object
io.github.mahmoudimus.quic.Hkdf
public final class Hkdf extends Object
HKDF (RFC 5869) over an HMAC, and the HKDF-Expand-Label of TLS 1.3 (RFC 8446 section 7.1) that QUIC uses for its secrets and keys (RFC 9001 section 5.1).

Instances are immutable and thread-safe; each call makes its own Mac.

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final Hkdf
    SHA256
    HKDF with HMAC-SHA256, for the SHA-256 cipher suites and QUIC's Initial secrets.
    static final Hkdf
    SHA384
    HKDF with HMAC-SHA384, for TLS_AES_256_GCM_SHA384.

  • Method Summary

    Modifier and Type
    Method
    Description
    byte[]
    expand(byte[] prk, byte[] info, int length)
    HKDF-Expand(prk, info, length).
    byte[]
    expandLabel(byte[] secret, String label, byte[] context, int length)
    TLS 1.3's HKDF-Expand-Label(secret, label, context, length), with the "tls13 " prefix added to label.
    byte[]
    extract(byte[] salt, byte[] ikm)
    HKDF-Extract(salt, ikm).
    int
    hashLength()
    The length of the hash, which is also the length of extract(byte[], byte[]) output.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • SHA256

      public static final Hkdf SHA256
      HKDF with HMAC-SHA256, for the SHA-256 cipher suites and QUIC's Initial secrets.

    • SHA384

      public static final Hkdf SHA384
      HKDF with HMAC-SHA384, for TLS_AES_256_GCM_SHA384.

  • Method Details

    • hashLength

      public int hashLength()
      The length of the hash, which is also the length of extract(byte[], byte[]) output.
      Returns:
      the hash length in bytes

    • extract

      public byte[] extract(byte[] salt, byte[] ikm)
      HKDF-Extract(salt, ikm).
      Parameters:
      salt - the salt; empty means a string of hashLength() zeros
      ikm - the input keying material
      Returns:
      the pseudorandom key, hashLength() bytes

    • expand

      public byte[] expand(byte[] prk, byte[] info, int length)
      HKDF-Expand(prk, info, length).
      Parameters:
      prk - the pseudorandom key, at least hashLength() bytes
      info - the context
      length - the output length, at most 255 times hashLength()
      Returns:
      the output keying material

    • expandLabel

      public byte[] expandLabel(byte[] secret, String label, byte[] context, int length)
      TLS 1.3's HKDF-Expand-Label(secret, label, context, length), with the "tls13 " prefix added to label.
      Parameters:
      secret - the secret to expand
      label - the label without its prefix, such as "quic key"
      context - the context, often empty or a transcript hash
      length - the output length, at most 65535
      Returns:
      the derived bytes