1# Key Derivation Overview and Algorithm Specifications
2
3
4To stretch keys into longer keys or to obtain keys in the required format, you can use the HUKS APIs to derive one or more secrete keys from a key (base key) by using a pseudorandom function.
5> **NOTE**
6>
7> * In HUKS, only the keys managed by HUKS can be used for key derivation.
8> * The mini-system devices do not support key derivation.
9
10## Supported Algorithms
11
12The following table lists the supported key derivation specifications.
13<!--Del-->
14The key management service specifications include mandatory specifications and optional specifications. Mandatory specifications are algorithm specifications that must be supported. Optional specifications can be used based on actual situation. Before using the optional specifications, refer to the documents provided by the vendor to ensure that the specifications are supported.
15
16**You are advised to use mandatory specifications in your development for compatibility purposes.**
17<!--DelEnd-->
18
19A derived key is the key session result obtained using the Init-Update-Finish mechanism. It can be managed by HUKS (the key is always in a [TEE](huks-concepts.md)) or independently managed by the service based on service requirements.
20> **NOTE**<br>
21> PBKDF2 and HKDF support only the keys that are managed within HUKS. They do not support the keys outside HUKS, such as the user passwords. For details about the keys managed in HUKS, see [Key Import Overview and Algorithm Specifications](huks-key-import-overview.md).
22
23| Algorithm/MD| Algorithm/Length of the Base Key| Available Algorithm/Length of the Derived Key| API Version| <!--DelCol5-->Mandatory|
24| -------- | -------- | -------- | -------- | -------- |
25| HKDF/SHA256 | AES/192-256 | AES/128/192/256<br>HMAC/8-1024<br>SM4/128 | 8+ | Yes|
26| HKDF/SHA384 | AES/256 | AES/128/192/256<br>HMAC/8-1024<br>SM4/128 | 8+ | Yes|
27| HKDF/SHA512 | AES/256 | AES/128/192/256<br>HMAC/8-1024<br>SM4/128 | 8+ | Yes|
28| PBKDF2/SHA256 | AES/192-256 | AES/128/192/256<br>HMAC/8-1024<br>SM4/128 | 8+ | Yes|
29| PBKDF2/SHA384 | AES/256 | AES/128/192/256<br>HMAC/8-1024<br>SM4/128 | 8+ | Yes|
30| PBKDF2/SHA512 | AES/256 | AES/128/192/256<br>HMAC/8-1024<br>SM4/128 | 8+ | Yes|
31<!--RP1--><!--RP1End-->
32