harmony 鸿蒙Key Derivation Using HKDF

2025-06-12
浏览 (6)

Key Derivation Using HKDF

For details about the corresponding algorithm specifications, see HKDF.

How to Develop

Create a HKDFSpec object and use it as a parameter for key derivation.

HKDFSpec is a child class of KdfSpec. You need to specify the following:

algName: algorithm to used, which is ‘HKDF’.
key: original key material. If key is of the string type, pass in the data used for key derivation instead of the string type such as HexString or base64. In addition, ensure that the string is encoded in UTF-8 format. Otherwise, the derived key may be different from what you expected.
salt: salt value.
info: optional context and application information used to expand the short key. This parameter can be empty.
keySize: length of the key to derive, in bytes. The value must be a positive integer.
Call cryptoFramework.createKdf with the string parameter ‘HKDF|SHA256|EXTRACT_AND_EXPAND’** to create a Kdf instance. The key derivation algorithm is HKDF, HMAC algorithm is SHA256, and mode is extract and expand.
Call Kdf.generateSecret with the HKDFSpec object to generate a derived key.

The following table lists how Kdf.generateSecret delivers the return value.

Return the result using await:

  import { cryptoFramework } from '@kit.CryptoArchitectureKit';
  import { buffer } from '@kit.ArkTS';

  async function kdfAwait() {
    let keyData = new Uint8Array(buffer.from("012345678901234567890123456789", "utf-8").buffer);
    let saltData = new Uint8Array(buffer.from("0123456789", "utf-8").buffer);
    let infoData = new Uint8Array(buffer.from("infostring", "utf-8").buffer);
    let spec: cryptoFramework.HKDFSpec = {
      algName: 'HKDF',
      key: keyData,
      salt: saltData,
      info: infoData,
      keySize: 32
    };
    let kdf = cryptoFramework.createKdf('HKDF|SHA256|EXTRACT_AND_EXPAND');
    let secret = await kdf.generateSecret(spec);
    console.info("key derivation output is " + secret.data);
  }

Return the result using a promise:

  import { cryptoFramework } from '@kit.CryptoArchitectureKit';
  import { BusinessError } from '@kit.BasicServicesKit';
  import { buffer } from '@kit.ArkTS';

  function kdfPromise() {
    let keyData = new Uint8Array(buffer.from("012345678901234567890123456789", "utf-8").buffer);
    let saltData = new Uint8Array(buffer.from("0123456789", "utf-8").buffer);
    let infoData = new Uint8Array(buffer.from("infostring", "utf-8").buffer);
    let spec: cryptoFramework.HKDFSpec = {
      algName: 'HKDF',
      key: keyData,
      salt: saltData,
      info: infoData,
      keySize: 32
    };
    let kdf = cryptoFramework.createKdf('HKDF|SHA256|EXTRACT_AND_EXPAND');
    let kdfPromise = kdf.generateSecret(spec);
    kdfPromise.then((secret) => {
      console.info("key derivation output is " + secret.data);
    }).catch((error: BusinessError) => {
      console.error("key derivation error.");
    });
  }

Return the result synchronously:

  import { cryptoFramework } from '@kit.CryptoArchitectureKit';
  import { BusinessError } from '@kit.BasicServicesKit';
  import { buffer } from '@kit.ArkTS';
  
  function kdfSync() {
    let keyData = new Uint8Array(buffer.from("012345678901234567890123456789", "utf-8").buffer);
    let saltData = new Uint8Array(buffer.from("0123456789", "utf-8").buffer);
    let infoData = new Uint8Array(buffer.from("infostring", "utf-8").buffer);
    let spec: cryptoFramework.HKDFSpec = {
      algName: 'HKDF',
      key: keyData,
      salt: saltData,
      info: infoData,
      keySize: 32
    };
    let kdf = cryptoFramework.createKdf('HKDF|SHA256|EXTRACT_AND_EXPAND');
    let secret = kdf.generateSecretSync(spec);
    console.info("[Sync]key derivation output is " + secret.data);
  }