Is it possible to use HKDF in the TPM? My goal is to load in a master symmetric key and derive keys from that using HKDF. I see there are other KDF functions available, but no mention of HKDF.


If it isn't in the spec it isn't in there. The question is if you need it if e.g. the NIST SP 800-108 KDF in counter mode is present. That's a fine KDF even if it lacks explicit extract / expand steps and salt. So I think you are only in big trouble if you need

  1. extract functionality;
  2. HKDF because of protocol compatibility.

There seems to be HMAC, but that is of little consolation: if you wanted to have the output key material as message outside of the TPM, then you wouldn't be needing the TPM. Furthermore, the Input Key Material (IKM) is used as HMAC message in HKDF-extract, so even the IKM won't be protected.

PS If you want to look for yourself: you find the algorithms in the document "Part 2: Structures", of all places:

Algorithm Name Value Reference Comments
PM_ALG_KDF1_SP800_56A 0x0020 NIST SP800-56A concatenation key derivation function (approved alternative 1) section 5.8.1
TPM_ALG_KDF2 0x0021 IEEE Std 1363a-2004 key derivation function KDF2 section 13.2
TPM_ALG_KDF1_SP800_108 0x0022 NIST SP800-108 a key derivation method Section 5.1 KDF in Counter Mode
  • Thanks for the answer. Unfortunately, I do need HKDF for protocol compatibility, which also implies that I need the extract functionality. Since the extract operation is only a single HMAC calculation, I was hoping there would be a way to achieve the same calculation without explicitly using a built-in HKDF command.
    – rkor
    Oct 4 at 4:12
  • 1
    One of the problems with HKDF is that it uses the IKM, the input keying material in the message part of HMAC. So if you have a hardware implementation of HMAC where the key is protected, it will probably only protect the input key, which - for HKDF extract - would be the salt. At that point you might as well use software. Sorry, I can only point out when I think it is not possible with version 2 of the TPM... Oct 4 at 7:53
  • That is the exact issue that I'm running into. I thought there might be a way to work around it. One thought was to load the master key into an NV register and then use TPM2_NV_Extend to perform the HMAC steps. However, I'm not finding any way to load an NV register with an existing symmetric key. Are there any other roundabout ways you can think of to make this work, @Maarten?
    – rkor
    Oct 5 at 2:58
  • I'm not that deep into TPM yet, but in general it seems that you are trying to do exactly the thing that any hardware key store / TPM is trying to defend against (other than leaking the key values, of course). For that reason I would be extremely surprised if there was a solution to this problem - but I've been surprised before. Oct 5 at 11:11
  • That makes sense. I really appreciate your help with this, but am wondering if this question might have a better chance of reaching a TPM expert if it was migrated to the Information Security site. I see you are moderator - would you be willing to do that @Maarten?
    – rkor
    Oct 5 at 14:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.