MCX MicrocontrollersのトピックRe: RFC5869 standard HKDF on Edgelock secure subsystem

RFC5869 standard HKDF on Edgelock secure subsystem

YosukeW — Thu, 23 Apr 2026 05:47:26 GMT

Hello,

I have one question about HKDF feature.
MCXN SRM shows that this supports RFC5869 but requires specific input data format:
"For RFC5869 compliance, the derivation data SW_DRV_DATA[255:0] must be composed as {label[247:0],
counter[7:0]} from the RFC5869 standard."
Actually RFC5869 requires 2 steps: Extract and Expand. And these steps require different inputs.
But, the above input data required by ELS seems compliant with Expand phase only.
Can we pass salt (measurement data) and label with IKM and let ELS do the 2 steps as defined in RFC5869 ?
Or is it processed by ELS in different manner ?

Thank you and Best regards, Yosuke

Re: RFC5869 standard HKDF on Edgelock secure subsystem

Celeste_Liu — Thu, 23 Apr 2026 10:52:34 GMT

Hello @YosukeW ,

I’ve noticed your case and will need some time to look into it further. I’ll keep you informed of any updates as soon as possible.

Have a nice day.

Celeste

Re: RFC5869 standard HKDF on Edgelock secure subsystem

Celeste_Liu — Mon, 27 Apr 2026 10:09:54 GMT

Hello @YosukeW ,

Thanks for your patience.

No, on MCX N23x/Nx4x ELS, the RFC5869-mode HKDF command does not expose separate Extract and Expand inputs , and the documentation describes the RFC5869 path as a single HMAC operation using a 256-bit derivation-data field . So you cannot pass salt plus IKM plus label and expect ELS to perform the full RFC5869 Extract then Expand sequence internally in the way RFC5869 defines it.

Hope it helps.

Celeste

Re: RFC5869 standard HKDF on Edgelock secure subsystem

YosukeW — Mon, 27 Apr 2026 22:43:25 GMT

Hello @Celeste_Liu ,

Thank you so much for answering my question.
It's clear to me now.

Best regards, Yosuke

Re: RFC5869 standard HKDF on Edgelock secure subsystem

Celeste_Liu — Tue, 28 Apr 2026 01:53:03 GMT

Hello @YosukeW ,

You are welcome, glad to help! Any new issues, welcome to create a new post.

Celeste