Elysia Tools

Browse tools, examples, visual explainers, and topic guides from one clear workspace.

Top Categories

Hubs

Language
ZHESPTRUFRDEEN

Elysia Tools

Navigation

Security

SP 800-56C HKDF Extract and Expand Walkthrough

· Last updated：2026-07-23

Show each HMAC step of HKDF Extract+Expand for protocol key derivation, including PRK, T(n), and OKM.

Details

What this tool helps you do

A deterministic SP 800-56C/RFC 5869 learning walkthrough for ECDH shared-secret derivation. It is for development and test vectors, not a secret-management service.

Execution

Run this tool

Fill in the form, run the tool, and review the result in one place.

Samples

Examples that match this tool

Related

Continue with connected tools and hubs

Written by the Elysia Tools team

Tool usage guide

Learn when to use this tool, what it supports, and how real users apply it.

Key facts

Category
Security
Input types
select, textarea, number
Output type
html
Sample coverage
4
API ready
Yes

Overview

The SP 800-56C HKDF Extract and Expand Walkthrough demonstrates deterministic HMAC-based key derivation for ECDH shared secrets and RFC 5869 test vectors. Choose a preset or enter IKM, salt, info, hash, encoding, and output length to inspect the PRK, T(n) blocks, and OKM.

When to use

  • Verify an RFC 5869 HKDF implementation against the published SHA-256 test case.
  • Study how SP 800-56C or HKDF Extract and Expand derives protocol key material from ECDH input.
  • Create development and test vectors with different hashes, encodings, salts, context info, and output lengths.

How it works

  1. 1Select a preset, or provide the input keying material using Hex, UTF-8 text, or Base64.
  2. 2Choose SHA-256, SHA-384, or SHA-512, then optionally enter a salt and protocol context in the Info field.
  3. 3Set the desired output length from 1 to 4096 bytes.
  4. 4The walkthrough calculates and displays the Extract PRK, each Expand block T(n), and the final OKM.

Use cases

  • Compare HKDF output with RFC 5869 test vectors during cryptographic implementation testing.
  • Trace ECDH shared-secret derivation for protocol design and debugging.
  • Generate reproducible examples for explaining HMAC-based key derivation.

Examples

1. RFC 5869 SHA-256 test vector

Cryptography developer

Background

A developer wants to confirm that an HKDF implementation matches the first published RFC 5869 SHA-256 test case.

Problem

The final 42-byte output must be checked along with the intermediate Extract and Expand values.

How to use

Select the RFC 5869 SHA-256 test case 1 preset, keep SHA-256 and Hex selected, and set the output length to 42 bytes.

Preset: RFC 5869 SHA-256 test case 1; Hash: SHA-256; Encoding: Hex; Length: 42 bytes.

Outcome

The walkthrough displays the PRK, two Expand blocks, and a 42-byte OKM that matches the published vector.

2. ECDH protocol key derivation walkthrough

Protocol engineer

Background

An engineer is reviewing how an ECDH shared secret becomes protocol-specific key material.

Problem

The engineer needs to inspect the effect of the selected hash, salt, context label, and output length on the derived bytes.

How to use

Choose the ECDH shared-secret demo or Custom values, enter the IKM in the chosen encoding, add optional Salt and Info values, select a hash, and set the required byte length.

FAQ

What does this HKDF walkthrough calculate?

It shows the HMAC steps for HKDF Extract and Expand, including PRK, T(n), and OKM.

Which hash algorithms are supported?

You can select SHA-256, SHA-384, or SHA-512.

Which input encodings can I use?

IKM, salt, and info values can be entered as Hex, UTF-8 text, or Base64 according to the selected encoding.

What happens if I omit the salt?

An empty salt uses a zero-filled salt with a length equal to the selected hash output length.

Is this a secret-management service?

No. It is a deterministic learning walkthrough for development and test vectors.

Home
Tools3201
Samples593
Visualizations465
Viewers103
Hubs233
Tags333
Images, Audio & Video657

Image, audio, and video processing, conversion, and optimization tools

Math, Date & Finance644

Calculators, numerics, date logic, statistics, and finance tools

Design & Color297

Color, layout, graphics, visual styling, and design helper tools

Text & Writing209

Writing, cleanup, formatting, extraction, and text analysis tools

Developer & Web193

Developer utilities, networking, web debugging, and automation helpers

Conversion & Encoding175

Format, file, archive, unit, and encoding conversion tools

FLAC/WAV Source Screening and Evidence Handoff
Self-Hosted Giveaway Widget Review and Embed Handoff
Stripe Promo Code Batch Review and Import Preflight
Batch Photo Culling Review and Editing Shortlist Handoff
UI Screenshot Structure Review and Development Handoff

© 2026 Elysia Tools. All rights reserved.

DocsPricingAboutTerms of ServicePrivacy PolicyCookiesContact
Java

Android Image Processing Java Samples

Android Java image processing examples including reading/saving images, scaling, and format conversion

Kotlin

Android Image Processing Kotlin Samples

Android Kotlin image processing examples including reading/saving images, scaling, and format conversion

Python

Web Image Processing Python Samples

Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion

Rust

Web Image Processing Rust Samples

Web Rust image processing examples including image read/save, scaling, and format conversion

Security

SSH Key Pair Generator

Generate an SSH key pair (Ed25519 recommended, RSA 4096, or ECDSA P-256) with an OpenSSH-format public key ready for ~/.ssh/authorized_keys, a SHA256 fingerprint, and a PEM private key. Optional passphrase encryption. Runs locally.

Security

PKCE Code Verifier & Challenge Generator

Generate, validate and verify OAuth2 / OIDC PKCE (RFC 7636) code_verifier and S256 code_challenge pairs. Three modes: (1) generate a fresh verifier + challenge from cryptographically secure random bytes at 256/384/512/768-bit entropy, (2) audit a verifier you already have against the RFC — length (43–128), charset [A-Za-z0-9-._~] and ≥256-bit entropy, and (3) verify a verifier/challenge pair by recomputing BASE64URL(SHA256(verifier)). Optionally build the full authorization-request URL and token-exchange body. Complements the generic nonce-generator (which only emits a verifier+challenge pair) with RFC-compliance auditing and pair verification.

Security

TOTP / HOTP Offline Code Generator

Generate RFC 6238 TOTP (time-based, 6/8 digits, 30/60s step) and RFC 4226 HOTP (counter-based) one-time passwords from a base32 shared secret, fully offline with HMAC-SHA1/256/512, plus an otpauth:// URI for importing into Google Authenticator / Authy

Data Processing

Data Column Extractor

Extract specific columns from tabular data with support for various formats and flexible column selection

Preset: ECDH shared-secret demo; Hash: SHA-256, SHA-384, or SHA-512; Encoding: Hex, UTF-8 text, or Base64; Length: 1–4096 bytes.

Outcome

The result presents the Extract PRK, sequential T(n) blocks, and the requested OKM for inspection and testing.