Key derivation

Purpose
​BLAKE2b can be used as a key derivation function (KDF) for high-entropy keys. It takes the following parameters to produce 256 to 512 bits of output keying material:
256 to 512 bits of input keying material (e.g. a shared secret).
A 128-bit personalisation constant (e.g. an application/protocol name).
A 128-bit salt (e.g. a counter or random data).
Optional contextual info of any length (e.g. an explanation of what the key will be used for).
This allows you to derive new, distinct keys from a high-entropy master key. For example, separate keys for encryption and authentication with Encrypt-then-MAC by changing the personalisation constant, salt, and/or info.
BLAKE2b is NOT suitable for deriving keys from passwords. Use Argon2id instead.
256-bit keys are recommended. Larger keys are unnecessary.
Usage
DeriveKey
Fills a span with output keying material computed from input keying material, a personalisation constant, a salt, and optional additional contextual info.
BLAKE2b.DeriveKey(Span<byte> outputKeyingMaterial, ReadOnlySpan<byte> inputKeyingMaterial, ReadOnlySpan<byte> personalisation, ReadOnlySpan<byte> salt, ReadOnlySpan<byte> info = default)
Exceptions
​ArgumentOutOfRangeException​
outputKeyingMaterial has a length less than MinKeySize or greater than MaxKeySize.
​ArgumentOutOfRangeException​
inputKeyingMaterial has a length less than MinKeySize or greater than MaxKeySize.
​ArgumentOutOfRangeException​
personalisation has a length not equal to PersonalSize.
​ArgumentOutOfRangeException​
salt has a length not equal to SaltSize.
​CryptographicException​
The key could not be derived.
Notes
The input keying material MUST be high in entropy (e.g. a shared secret).
Do NOT use the same output keying material for multiple purposes (e.g. encryption and authentication). You should derive separate keys using the same input keying material and personalisation but different salts and/or info.
If you intend to feed multiple variable-length inputs into the info, beware of canonicalization attacks. Please read the Concat page for more information.
Password hashing
Authenticated encryption
Last modified 3mo ago