Luigit
repositories / dotfiles

dotfiles

bugabingas dorkfiles

owned by admin

pi/agent/skills/optional/java/java-kdf-api/SKILL.md

Raw
Rendered preview

name: java-kdf-api description: "Use when Java 25+ crypto derives keys or bytes with javax.crypto.KDF, especially HKDF." license: CC-BY-4.0-summary compatibility: "JDK 25+" metadata: sources: - "https://openjdk.org/jeps/510" - "https://openjdk.org/jeps/452"

Key Derivation Function API

Use for Key Derivation Function API work from JEP 510 when targeting JDK 25+.

When active

  • Use KDF.getInstance("HKDF-SHA256") for HKDF.
  • Use HKDFParameterSpec extract/expand specs.
  • Use deriveKey for SecretKey output or deriveData for byte output.

Pitfalls

  • PBKDF2 remains under SecretKeyFactory; JEP 510 does not move it to KDF.
  • Do not use KeyGenerator for deterministic KDF derivation.
  • Provider-specific KDFs need their own AlgorithmParameterSpec.

Examples

Read examples/jep-510.md for JEP-derived snippets.

References

---
name: java-kdf-api
description: "Use when Java 25+ crypto derives keys or bytes with `javax.crypto.KDF`, especially HKDF."
license: CC-BY-4.0-summary
compatibility: "JDK 25+"
metadata:
  sources:
    - "https://openjdk.org/jeps/510"
    - "https://openjdk.org/jeps/452"
---

# Key Derivation Function API

Use for **Key Derivation Function API** work from [JEP 510](https://openjdk.org/jeps/510) when targeting JDK 25+.

## When active

- Use `KDF.getInstance("HKDF-SHA256")` for HKDF.
- Use `HKDFParameterSpec` extract/expand specs.
- Use `deriveKey` for `SecretKey` output or `deriveData` for byte output.

## Pitfalls

- PBKDF2 remains under `SecretKeyFactory`; [JEP 510](https://openjdk.org/jeps/510) does not move it to KDF.
- Do not use `KeyGenerator` for deterministic KDF derivation.
- Provider-specific KDFs need their own `AlgorithmParameterSpec`.

## Examples

Read `examples/jep-510.md` for JEP-derived snippets.

## References

- https://openjdk.org/jeps/510
- https://openjdk.org/jeps/452