Algorithm Identifiers for the HMAC-based Extract-and-Expand Key Derivation Function (HKDF)
RFC XXXX
Russell Housley
Vigil Security, LLC
515 Dranesville Road
Herndon, VA 20170
United States of America
housley@vigilsec.com
June 2019
HKDF, Algorithm Identifier
RFC 5869 specifies the HMAC-based Extract-and-Expand Key Derivation Function (HKDF) algorithm. This document assigns algorithm identifiers to the HKDF algorithm when used with three common one-way hash functions.
Introduction
The HKDF algorithm [RFC5869] is a key derivation function based on the Hashed Message Authentication Code (HMAC). This document assigns algorithm identifiers to the HKDF algorithm when used with three common one-way hash functions. These algorithm identifiers are needed to make use of the HKDF in some security protocols, such as the Cryptographic Message Syntax (CMS) [RFC5652].
Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.
ASN.1
In this specification, values are generated using ASN.1 [X.680] using the Basic Encoding Rules (BER) and the Distinguished Encoding Rules (DER) [X.690].
HKDF Algorithm Identifiers
This section assigns three algorithm identifiers to HKDF [RFC5869] used with three common one-way hash functions that are specified in [SHS]: SHA-256, SHA-384, and SHA-512. When any of these three object identifiers appear within the ASN.1 type AlgorithmIdentifier, the parameters component of that type SHALL be absent.
The specification of AlgorithmIdentifier is available in [RFC5911], which evolved from the original definition in X.509 [X.509-88].
The assigned object identifiers are:

id-alg-hkdf-with-sha256 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
    us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) alg(3) 28 }

id-alg-hkdf-with-sha384 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
    us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) alg(3) 29 }

id-alg-hkdf-with-sha512 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
    us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) alg(3) 30 }

ASN.1 Module
This section contains the ASN.1 module for the HKDF algorithm identifiers. This module imports types from other ASN.1 modules that are defined in [RFC5912].

HKDF-OID-2019
  { iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1) pkcs-9(9)
    smime(16) modules(0) id-mod-hkdf-oid-2019(68) }

DEFINITIONS IMPLICIT TAGS ::=
BEGIN

-- EXPORTS All

IMPORTS

AlgorithmIdentifier{}, KEY-DERIVATION
  FROM AlgorithmInformation-2009  -- [RFC5912]
    { iso(1) identified-organization(3) dod(6) internet(1)
      security(5) mechanisms(5) pkix(7) id-mod(0)
      id-mod-algorithmInformation-02(58) } ;

--
-- Object Identifiers
--

id-alg-hkdf-with-sha256 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
    us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) alg(3) 28 }

id-alg-hkdf-with-sha384 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
    us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) alg(3) 29 }

id-alg-hkdf-with-sha512 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
    us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) alg(3) 30 }

--
-- Key Derivation Algorithm Identifiers
--

KeyDevAlgs KEY-DERIVATION ::= {
  kda-hkdf-with-sha256 |
  kda-hkdf-with-sha384 |
  kda-hkdf-with-sha512,
  ... }

kda-hkdf-with-sha256 KEY-DERIVATION ::= {
    IDENTIFIER id-alg-hkdf-with-sha256
    PARAMS ARE absent
    SMIME-CAPS { IDENTIFIED BY id-alg-hkdf-with-sha256 } }

kda-hkdf-with-sha384 KEY-DERIVATION ::= {
    IDENTIFIER id-alg-hkdf-with-sha384
    PARAMS ARE absent
    SMIME-CAPS { IDENTIFIED BY id-alg-hkdf-with-sha384 } }

kda-hkdf-with-sha512 KEY-DERIVATION ::= {
    IDENTIFIER id-alg-hkdf-with-sha512
    PARAMS ARE absent
    SMIME-CAPS { IDENTIFIED BY id-alg-hkdf-with-sha512 } }

END

Security Considerations
Despite the simplicity of HKDF, there are many security considerations that have been taken into account in the design and analysis of this construction. An exposition of all of these aspects is well beyond the scope of this document. Please refer to [EPRINT] for detailed information, including rationale for the HKDF design.
IANA Considerations
One object identifier for the ASN.1 module in Section 3 was assigned in the "SMI Security for S/MIME Module Identifiers (1.2.840.113549.1.9.16.0)" registry [IANA-MOD]:

id-mod-hkdf-oid-2019 OBJECT IDENTIFIER ::= {
   iso(1) member-body(2) us(840) rsadsi(113549) pkcs(1)
   pkcs-9(9) smime(16) mod(0) 68 }

Three object identifiers for the HKDF algorithm identifiers were assigned in the "SMI Security for S/MIME Algorithms (1.2.840.113549.1.9.16.3)" registry [IANA-ALG]:

id-alg-hkdf-with-sha256 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
    us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) alg(3) 28 }

id-alg-hkdf-with-sha384 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
    us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) alg(3) 29 }

id-alg-hkdf-with-sha512 OBJECT IDENTIFIER ::= { iso(1) member-body(2)
    us(840) rsadsi(113549) pkcs(1) pkcs-9(9) smime(16) alg(3) 30 }

References
Normative References
[SHS]

Secure Hash Standard (SHS)
DOI 10.6028/NIST.FIPS.180-4
FIPS PUB 180-4
National Institute of Standards and Technology (NIST)
August 2015
[RFC2119]

Key words for use in RFCs to Indicate Requirement Levels
DOI 10.17487/RFC2119
RFC 2119
BCP 14
S. Bradner
March 1997
[RFC5652]

Cryptographic Message Syntax (CMS)
DOI 10.17487/RFC5652
RFC 5652
STD 70
R. Housley
September 2009
[RFC5869]

HMAC-based Extract-and-Expand Key Derivation Function (HKDF)
DOI 10.17487/RFC5869
RFC 5869
H. Krawczyk
P. Eronen
May 2010
[RFC8174]

Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words
DOI 10.17487/RFC8174
RFC 8174
BCP 14
B. Leiba
May 2017
[X.680]

Information technology -- Abstract Syntax Notation One (ASN.1): Specification of basic notation
ISO/IEC 8824-1:2015
ITU-T Recommendation X.680
ITU-T
August 2015
[X.690]

Information technology -- ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER)
ISO/IEC 8825-1:2015
ITU-T Recommendation X.690
ITU-T
August 2015
Informative References
[EPRINT]

Cryptographic Extraction and Key Derivation: The HKDF Scheme
Proceedings of CRYPTO 2010
H. Krawczyk
August 2010
[IANA-ALG]

SMI Security for S/MIME Algorithms (1.2.840.113549.1.9.16.3)
IANA
[IANA-MOD]

SMI Security for S/MIME Module Identifier (1.2.840.113549.1.9.16.0)
IANA
[RFC5911]

New ASN.1 Modules for Cryptographic Message Syntax (CMS) and S/MIME
DOI 10.17487/RFC5911
RFC 5911
P. Hoffman
J. Schaad
June 2010
[RFC5912]

New ASN.1 Modules for the Public Key Infrastructure Using X.509 (PKIX)
DOI 10.17487/RFC5912
RFC 5912
P. Hoffman
J. Schaad
June 2010
[X.509-88]

Recommendation X.509: The Directory - Authentication Framework
CCITT
1988