hkdf

What it is and what it does

HKDF is a cryptographic key derivation function that implements the HMAC-based Extract-and-Expand Key Derivation Function as specified in the draft RFC. It takes input key material (typically a password or shared secret) and derives one or more cryptographically strong keys suitable for use in encryption, authentication, or other cryptographic operations. The package provides both a functional interface (separate `hkdf_extract()` and `hkdf_expand()` functions) and a wrapper class (`Hkdf`) for convenience.

The functional interface defaults to SHA-512 for hashing, while the wrapper class defaults to SHA-256. Both allow you to specify a custom hash function. The extract phase produces a pseudorandom key (PRK) from input material and an optional salt; the expand phase then generates output key material of a specified length, optionally parameterized by context information. This is useful when you need to derive multiple independent keys from a single source or when you need to convert weak input into strong cryptographic material.

Use it for:

• Derive encryption keys from a user password in a password-based key derivation workflow.
• Generate multiple independent session keys from a single shared secret in a protocol handshake.
• Expand a master key into subkeys for different purposes (e.g., encryption, authentication, integrity).
• Implement cryptographic protocols that require HKDF-based key material generation.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Implements HMAC-based Key Derivation Function (HKDF) with extract-and-expand operations for deriving cryptographic keys from input key material.

No. The package is dormant (last release 2015-06-16, classifiers list only Python 2.6–3.4, all end-of-life), has high install friction (source-only), and offers no runtime dependencies to ease integration. Install only if you are maintaining legacy Python 2 code that already depends on it.

Install

hkdf on PyPI

pip install hkdf

uv add hkdf

poetry add hkdf

Installing hkdf

Before you install

High install friction due to source-only distribution (hkdf-0.0.3.tar.gz). Maintenance is dormant—last release was 2015-06-16 and last commit 2024-01-17, with no recent activity. Classifiers indicate support only for Python 2.6, 2.7, 3.3, 3.4, all of which are end-of-life.

License in practice

Licensed under BSD (permissive), which permits commercial and private use with minimal restrictions. No notable licensing constraints for most use cases.

Quickstart

from hkdf import hkdf_extract, hkdf_expand
from binascii import unhexlify

prk = hkdf_extract(unhexlify(b"8e94ef805b93e683ff18"), b"asecretpassword")
key = hkdf_expand(prk, b"context1", 16)

No runtime dependencies, but package is source-only and classifiers list only Python 2.6–3.4, all end-of-life versions. Compatibility with modern Python versions is unverified.

Verify before relying

• Whether the package actually works on Python 3.5 or later despite classifiers listing only 2.6–3.4.
• Whether any security review or audit has been performed on the HKDF implementation since 2015.
• Current maintenance status and whether the author is accepting pull requests or bug reports.

Package facts

Evidence: hkdf-0.0.3.tar.gz

Tags

More Cryptography packages