Crate ic_kdf 

ic-kdf — key derivation

• hkdf — RFC 5869 extract-and-expand (SP 800-56C two-step).
• pbkdf2() — SP 800-132 password-based derivation.
• kbkdf — SP 800-108 counter-mode KDF over HMAC.
• argon2() — RFC 9106 memory-hard password hashing.

The HMAC-based functions are generic over the instantiation, so the same code path serves SHA-256, SHA-384, SHA-512, and the SHA-3 family.

Choosing between the two password KDFs

pbkdf2() is the only approved option and is not memory-hard, so a GPU attacks it far faster than a CPU defends it. argon2() is memory-hard and is what RFC 9106 recommends, but is not FIPS-approved. If you have a FIPS obligation the choice is made for you; otherwise reach for Argon2id.

use ic_kdf::hkdf::Hkdf;
use ic_core::traits::Kdf;
use ic_mac::HmacSha256;

let mut key = [0u8; 32];
Hkdf::<HmacSha256>::derive(b"input keying material", b"salt", b"app v1", &mut key)?;

Re-exports

pub use argon2::argon2;

pub use argon2::Argon2Params;

pub use argon2::Variant;

pub use hkdf::Hkdf;

pub use kbkdf::kbkdf_counter;

pub use pbkdf2::pbkdf2;

Modules

argon2

RFC 9106 Argon2, the memory-hard password hash.

hkdf

RFC 5869 HKDF: extract-then-expand.

kbkdf

SP 800-108 KDF in counter mode.

pbkdf2

SP 800-132 / RFC 8018 PBKDF2.

Constants

KDF_IDS

Ontology identifiers for the KDFs this crate provides.

PBKDF2_MIN_RECOMMENDED_ITERATIONS

The SP 800-132 floor for PBKDF2 iterations in new deployments.