---
id: 1436
title: "Best practices for key derivation"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2025/01/28/best-practices-for-key-derivation/"
published_at: "2025-01-28 14:00"
tags: ["cryptography", "api-security", "best-practices", "trail-of-bits", "key-derivation", "kdf", "hkdf"]
phying_url: "https://phying.com/item/1436"
lang: en
---

# Best practices for key derivation

## Summary

Trail of Bits covers KDF best practices: HKDF extraction and expansion, misuse patterns like the Flickr API signature forgery, and guidance on salts, info parameters, and combining keys.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2025-01-28 14:00
- **Original:** https://blog.trailofbits.com/2025/01/28/best-practices-for-key-derivation/
- **Phying News:** https://phying.com/item/1436