Key Derivation Function API

Java 25 Course · lesson 11 of 16 · 3 min read

A standard way to turn one secret into many keys, finalised in 25.

Open this lesson in the learning hub

Key points

  • Protocols routinely need several keys - encrypt one way, authenticate another - from a single shared secret.
  • A KDF derives them deterministically so both sides compute the same keys without extra exchange.
  • JEP 510 finalises javax.crypto.KDF so providers expose HKDF and friends through one interface.
  • It complements the KEM API from 21: KEM agrees the secret, KDF expands it into usable keys.
  • Doing this by hand is a classic way to build a weak protocol, which is why it belongs in the JDK.

KEM agrees the secret and KDF expands it - together they cover the key setup a protocol needs.

Primitive patterns keep previewing PEM encodings (preview)

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the Java 25 Course course, and every lesson in it is listed on the Java 25 Course contents page.