GoLang hash_hkdf

request it (271)
GoLang replacement for PHP's hash_hkdf [edit | history]

Do you know a GoLang replacement for PHP's hash_hkdf? Write it!

PHP hash_hkdf

PHP original manual for hash_hkdf [ show | php.net ]


(PHP 7 >= 7.1.2)

hash_hkdfGenerate a HKDF key derivation of a supplied key input


string hash_hkdf ( string $algo , string $ikm [, int $length = 0 [, string $info = '' [, string $salt = '' ]]] )



Name of selected hashing algorithm (i.e. "sha256", "sha512", "haval160,4", etc..) See hash_algos() for a list of supported algorithms.


Non-cryptographic hash functions are not allowed.


Input keying material (raw binary). Cannot be empty.


Desired output length in bytes. Cannot be greater than 255 times the chosen hash function size.

If length is 0, the output length will default to the chosen hash function size.


Application/context-specific info string.


Salt to use during derivation.

While optional, adding random salt significantly improves the strength of HKDF.

Return Values

Returns a string containing a raw binary representation of the derived key (also known as output keying material - OKM); or FALSE on failure.


An E_WARNING will be raised if ikm is empty, algo is unknown/non-cryptographic, length is less than 0 or too large (greater than 255 times the size of the hash function).


Example #1 hash_hkdf() example

// Generate a random key, and salt to strengthen it during derivation.
$inputKey random_bytes(32);
$salt random_bytes(16);

// Derive a pair of separate keys, using the same input created above.
$encryptionKey hash_hkdf('sha256'$inputKey32'aes-256-encryption'$salt);
$authenticationKey hash_hkdf('sha256'$inputKey32'sha-256-authentication'$salt);

var_dump($encryptionKey !== $authenticationKey); // bool(true)

The above example produces a pair of separate keys, suitable for creation of an encrypt-then-HMAC construct, using AES-256 and SHA-256 for encryption and authentication respectively.

See Also