Google Cryptographer (Entry Level) Interview Preparation Guide

Approach / Framework

1. Clarify inputs: NIST-style vector files (hex, ASN.1, JSON), target primitives (AES, SHA-256, RSA).
2. Build modular harness: parser, canonicalizer, runner, comparer, reporter.

Design

• Parser: pluggable readers per format (hex lines, JSON). Normalize to a dict: {name, inputs, expected, meta}.
• Canonicalizer: convert endianness (bytes.fromhex / int.to_bytes), normalize padding, ASN.1 decode for RSA.
• Runner: call pure-Python implementations or subprocess / dynamic import; support sync/async.
• Comparator: constant-time compare for secrets; produce unified diff for mismatches (difflib).
• Reporter: JUnit XML + human-readable summary.

Key implementation snippet

# example runner loop
for vec in vectors:
    inp = canonicalize(vec['input'])
    out = impl.run(**inp)                # impl API per primitive
    ok = hmac.compare_digest(out, vec['expected'])
    if not ok: diffs.append((vec, unified_diff(out,vec['expected'])))

CI integration

• Run harness in pipeline stage; fail build on regressions; publish JUnit XML and artifact diffs.
• Cache known-good vectors; pin implementation versions; run full test matrix nightly.

Randomness-dependent tests

• Replace RNG with deterministic CSPRNG seeded from vector meta for reproducibility; for tests requiring entropy, run multiple stochastic trials and assert statistical properties; mark flaky Monte-Carlo as non-blocking on PRs and gated to nightly.

Overview
I would design unit, property and fuzz tests that exercise parsing, signing, verification, and error handling for RSA‑PSS, ECDSA (P-256/P-384), and EdDSA (Ed25519). Tests run in CI with gating stages: fast unit tests on push, extended fuzz + property tests nightly, and coverage/fuzz minimizers on release.

Canonical vectors

• Use RFC 8032 Ed25519 test vectors.
• Use NIST FIPS 186-4 ECDSA and RSA-PSS vectors (known messages, salts, keys).
  Why: ensures interoperability and deterministic correctness.

Negative / malformed tests (concrete cases)

1. DER-encoded ECDSA signature with extra trailing byte — catches parser ignoring trailing data.
2. DER with length off-by-one in R or S — detects length-parsing bugs.
3. ASN.1 integer with leading zero omitted — finds canonicalization issues.
4. RSA-PSS with incorrect salt length field — catches incorrect salt handling.
5. Ed25519 signature with bit-twiddled high bit of last byte — catches bitmasking errors.
6. Public key length too short/long for curve — catches bounds checks.
7. Zeroed private key material — ensures rejection/handling.
8. Replayed signature with different message — ensures message-binding check.

Fuzz targets

• Parser for public/private keys (DER/PKCS8/SPKI)
• Signature verifiers (feed random sig,msg,key)
• RSA-PSS parameter parser (saltLen/hash)
  Why: exercises state machines and memory safety.

Property-based tests

• Modified message -> verification fails (mutation testing across 1000 seeds)
• Deterministic signing (Ed25519) matches RFC vector
• Sign/verify roundtrip for each algorithm for random keys/messages
• ECDSA low-S canonicalization property: signature normalized and still verifies

CI gating

• Unit tests + linters + static analysis on every PR
• Quick fuzz sanitizer (ASAN/UBSAN) job on PR
• Nightly heavy fuzz corpus + coverage reporting; fails build if new critical sanitizer issues or regressions
• Require minimizer and testcase reproduction for any failing fuzz input before merge

These tests collectively catch parsing bugs, canonicalization errors, parameter mishandling, and memory/logic vulnerabilities common in signature libraries.

Answer (Cryptographer perspective)

Euclidean algorithm steps

• 240 = 11 × 21 + 9
• 11 = 9 × 1 + 2
• 9 = 2 × 4 + 1
• 2 = 1 × 2 + 0

gcd(240,11) = 1 (coprime, so inverse exists).

Back-substitution to express 1 = a·240 + b·11

• 1 = 9 − 2×4
• 2 = 11 − 9×1 ⇒ 1 = 9 − (11 − 9)×4 = 9×5 − 11×4
• 9 = 240 − 11×21 ⇒ 1 = (240 − 11×21)×5 − 11×4 = 240×5 − 11×105 − 11×4
• Combine: 1 = 240×5 − 11×109

So integers a = 5, b = −109 satisfy 1 = 5·240 + (−109)·11.

Modular inverse

• 11^(-1) mod 240 ≡ −109 mod 240 ≡ 131
• Check: 11×131 = 1441 ≡ 1 (mod 240)

Therefore gcd = 1 and the modular inverse of 11 modulo 240 is 131.

Direct answer

Applying STRIDE's Information Disclosure and Tampering categories separately to a relational database (RDBMS), an object store, and an in-memory cache matters because personally identifiable information (PII) leaks and gets modified through different mechanisms in each: the RDBMS is exposed mainly through query-layer access and backups, the object store through overly broad bucket policies and pre-signed URLs, and the cache through its usually-weaker default access model and the fact that data there is often copied out of the encrypted-at-rest system entirely. A workable encryption and key-management architecture uses envelope encryption with a central key management service (KMS), per-datastore access scoping, and a rotation plan, and treats the cache as a datastore that must hold ciphertext like the other two rather than as a performance layer exempt from the policy. The latency objection to encrypting the cache is real, but it is answered by WHERE the data key is held, not by conceding the cache to plaintext.

Structured elaboration

Information Disclosure and Tampering, mapped per datastore:

Encryption and key-management architecture.

Use envelope encryption everywhere PII is written: a central KMS holds and protects a small number of long-lived key-encryption keys (KEKs), while each record, object, or cache entry is encrypted under its own data-encryption key (DEK), which is itself encrypted by a KEK and stored alongside the ciphertext. This bounds the blast radius of a single leaked DEK to the data it actually protects, while keeping the expensive, access-controlled operation (calling the KMS) infrequent rather than on every read.

• RDBMS: column-level or field-level encryption for PII columns specifically (not full-disk encryption alone, which protects against a stolen physical disk but does nothing against a live, authenticated query reading the column in plaintext), with the DEK-per-tenant or DEK-per-sensitivity-class pattern so a single compromised DEK does not expose every customer's PII at once.
• Object store: server-side encryption with the KMS-managed key at write time, bucket policies scoped to least privilege per service, and short-lived, narrowly scoped pre-signed URLs (minutes, not days) generated only for the specific object and action needed, since a pre-signed URL is effectively a bearer credential for as long as it is valid.
• In-memory cache: encrypt PII fields before they enter the cache (application-layer encryption of the specific fields, not relying on the cache's own at-rest encryption, if any) so the cache only ever stores ciphertext plus the wrapped DEK reference, and cache invalidation on the source record's update includes invalidating the cached ciphertext so a rotated key does not leave stale plaintext-equivalent data reachable.

KMS usage, rotation, access control. Every DEK-unwrap operation goes through the KMS's access-control policy, which is where authorization actually lives (not application-level checks alone, which a compromised application process could bypass); scope KMS grants per service and per key-purpose, the same least-privilege principle as the datastore access controls themselves, so a service that only needs to decrypt cannot also request new key material or export raw key bytes. Rotate KEKs on a defined interval (commonly annually to a few years for infrequently-changing KEKs, since KMS providers typically support rotating the KEK while keeping older KEK versions available to decrypt DEKs wrapped under them) and rotate DEKs more frequently or per-write, since DEKs are cheap to generate and rotating them limits how much data any single DEK compromise exposes.

Performance trade-offs. The RDBMS and object store can absorb encryption's overhead reasonably well: column-level encryption adds CPU cost per row and can complicate range queries and indexing on encrypted columns (an encrypted column generally cannot be efficiently range-queried or sorted by the database engine itself), and object-store server-side encryption is close to free since it happens at the storage layer. The cache is the outlier: its entire value proposition is sub-millisecond reads, and calling out to a KMS or even doing local decryption on every cache hit can erode a meaningful fraction of that latency budget. The practical resolution is to decrypt once per process and hold the DEK (not the KMS-wrapped key) in memory for the service's lifetime or a bounded window, so the expensive KMS call happens rarely, while the cheap local decryption happens on each read, accepting that this keeps live plaintext-equivalent key material in the consuming service's process memory as a residual risk, mitigated by process isolation and short DEK lifetimes rather than eliminated. Be precise about which process that is: the DEK belongs in the service that reads and decrypts, never in the caching tier itself. A cache holding both the ciphertext and the key that opens it is storing plaintext with extra steps, and it would give back exactly the protection this design was built to gain.

Worked example

Trace one concrete flow: a customer support tool reads a customer's profile, which the RDBMS stores with an encrypted PII column (address, encrypted under a DEK wrapped by a KEK in the KMS), and caches the decrypted profile for 5 minutes to avoid re-querying the database on every support-tool page load. Under this design, the Information Disclosure risk in the RDBMS is addressed (a raw database dump exposes only ciphertext), but the cache now holds plaintext PII for up to 5 minutes, meaning the cache inherits the disclosure risk the database no longer has. If the cache's access control is weaker than the database's (a common real-world pattern, since caches are often treated as purely a performance layer rather than a data-sensitivity boundary), this flow has effectively moved the weakest link from the database to the cache rather than eliminating it. The fix that keeps the performance benefit without reintroducing the disclosure risk is to cache the encrypted form (ciphertext plus wrapped-DEK reference) instead of the decrypted profile, decrypting only in the requesting service's own memory at read time; the cache still saves the database round trip, but a compromised cache no longer directly yields plaintext PII.

Trade-offs and pitfalls

The most common mistake is applying full-disk or storage-layer encryption everywhere and treating that as equivalent to field-level protection against Information Disclosure; storage-layer encryption defends against a stolen disk or snapshot, not against an authenticated read path, which is the more common real-world disclosure path for all three datastores. A second is under-protecting the cache specifically, on the reasoning that "it's just a performance layer," when in practice the cache is frequently the datastore with the weakest access control and the one most likely to hold decrypted PII copied out of a properly encrypted source. A third pitfall on the Tampering side is trusting cache reads without re-validating against the source of truth for anything security-sensitive; a poisoned cache entry can silently serve tampered data to every subsequent reader until the entry's time-to-live (TTL) expires, so cache entries for sensitive fields should carry a way to detect tampering (an integrity tag alongside the ciphertext) even though the cache itself is not the system of record. Finally, KMS access-control scoping is easy to get right for who can decrypt and easy to get wrong for who can rotate, export, or delete key material; those higher-privilege KMS operations deserve tighter, more actively monitored access than routine decrypt calls, since abusing them can be far more damaging than any single record-level disclosure.

Direct answer

State a genuine preference (or an honest "it depends on this stage of my own career") backed by two or three concrete trade-offs that matter most to you personally, not a generic recited list of pros and cons.

Structured elaboration

What this question screens for
Whether you've actually thought about how company stage affects your day-to-day work, versus giving a textbook answer. It also probes whether you can name a genuine downside of your own stated preference.

The core trade-offs

Name which two or three rows matter most to YOU specifically, and why. That's what turns this table into a real answer instead of a recited summary.

Worked example

The same trade-offs show up in what kind of problems you get handed. At an early-stage company, a candidate in this field might get an open-ended question like "[a validation or discovery-shaped question typical of your discipline early in a company's life]." At an established company, the equivalent question is narrower, something like "[a well-scoped optimization or risk-reduction question typical of your discipline at scale]." Swap the example questions for your own discipline: a security-focused role might weigh "is this new integration safe to ship" at an early-stage company against "how do we harden a system that's already in production" at an established one; a data role might weigh "do we even have the right metric" against "how do we make this metric pipeline auditable at scale."

Trade-offs and pitfalls

• Red flag: a generic answer that lists textbook pros and cons without saying which ones matter to you and why; interviewers want your actual priorities, not a summary.
• Red flag: dismissing the company you're interviewing with, if it's the "other" stage from your stated preference, without addressing the mismatch directly.
• Pitfall: treating this as strictly binary. The honest answer often depends on the specific team's stage, not just company headcount, since a large company can have a scrappy, early-stage-feeling internal team.
• Pitfall: over-indexing on compensation structure alone (equity vs. cash) as the deciding trade-off, which reads as motivated more by upside than by the work itself.

Direct answer

When a security or compliance team has the authority to block work and uses it, the goal isn't to overpower them, it's to give them a way to say yes that they would defend to their own leadership. That means understanding the actual concern, proposing controls that address it directly, and building a record that makes the eventual approval easy to justify upward, rather than skipping the concern to hit a deadline.

Structured elaboration

1. Understand the veto, not just the outcome

Ask what specifically drives the block: a known threat pattern, a regulatory obligation, a past incident. A block framed as 'this is too risky' usually decomposes into something concrete once you ask what evidence would change their mind.

2. Propose compensating controls, not blanket reassurance

Bring specific mitigations that map to the stated concern: scoped access, monitoring, a rollback plan, data masking, a smaller blast radius. 'Trust me' rarely moves a team whose job is to not just trust people; a control they can point to in an audit does.

3. Phase the ask so risk and trust build together

Instead of asking for full approval up front, propose a smaller, monitored first step, then expand once it holds up. This gives the blocking team evidence rather than a promise, and it gives you a faster initial yes.

4. When you need executives to sponsor it, not just the compliance team to approve it

Sometimes getting to yes isn't about convincing the blocking team at all, it's about persuading senior executives, without formal authority over them, to sponsor a security or compliance investment that trades short-term revenue for long-term risk reduction. That's a different move: build the case in terms an executive already weighs (the cost of the exposure versus the cost and timeline of the fix), find a credible sponsor who already has their ear, and time the ask to a moment they're already thinking about risk, such as a renewal, an audit, or a near-miss. State the trade-off plainly rather than downplaying either the revenue impact or the risk.

5. When the conflict runs the other direction

The pressure isn't always compliance blocking a launch. Sometimes compliance demands collecting more data for audit purposes, and that request conflicts with the team's own privacy commitments to users. Handle this the same way: scope exactly what the audit requirement needs, then look for a way to satisfy it without violating the privacy commitment, such as aggregating instead of storing per-user data, sampling instead of full capture, or purpose-limited access with automatic expiry. If a genuine conflict remains after that, escalate it as a policy conflict for someone empowered to decide between the two obligations, rather than either side unilaterally overriding the other.

Worked example

A security team initially blocks a new integration on a financial product, citing customer-data exposure risk. Working sessions with security and the app owner map the specific risk to two things: a broad data scope and no kill switch. The team proposes scoped test accounts, data masking, and a remote kill switch, then agrees to a phased rollout: verify the low-risk paths first, escalate to the higher-risk ones only after the first phase holds up under monitoring. Security signs off on the phased plan. Separately, when the same team later wants to expand data collection to satisfy a new audit requirement, they find that a sampled, time-limited collection window satisfies the auditors just as well as full, indefinite collection, so the privacy commitment to users doesn't have to give.

Trade-offs and pitfalls

• Working around a block quietly (shipping a smaller version without telling the blocking team) buys short-term speed and damages the relationship you will need next time; always close the loop even when you find a narrower path.
• Compensating controls that never get revisited become permanent scaffolding; agree upfront on when the phased approach graduates to full trust, not just how it starts.
• On the upward-influence path, leading with fear rather than a clear trade-off tends to get budget approved once and then quietly deprioritized later, because the executive never actually weighed the cost against the risk. Naming the trade-off explicitly is what makes the commitment durable.
• Overriding a genuine policy conflict (audit needs versus privacy commitments) unilaterally, instead of escalating it, tends to resurface as a bigger trust problem with users or regulators later than the original block would have cost in time.

High-level point: Hashing multiple entropy sources is fine as an “entropy combiner” if you treat hashing as extraction (remove bias, collisions) and you have reliable, independent, min-entropy estimates. For a production RNG with long-lived state, prefer a standardized DRBG (e.g., HMAC-DRBG / CTR-DRBG / Hash-DRBG) because it provides proven extract-then-expand primitives, internal state management, reseeding logic, and forward/backward security guarantees.

Why simple hashing can be adequate

• Use-case: one-shot seed accumulation (e.g., boot seed) where you collect many independent sources and immediately seed a secure PRF-based generator.
• Requirements: each source has quantified min-entropy; adversary cannot control > allowed threshold; you apply a proper extractor (HMAC or HKDF-style keyed extract) rather than raw hash concatenation.
• Example: seed = HKDF-Extract(salt, concat(samples)) then key the PRF. HKDF provides proven entropy extraction even when some inputs are weak.

When to use a standardized DRBG

• Long-lived generator, repeated outputs, networked devices, or where state compromise is a real risk.
• DRBGs specify internal state update rules, reseed intervals, prediction resistance modes, and limits on output-per-seed (e.g., NIST SP800‑90A constraints).
• HMAC-DRBG gives a keyed PRF with internal K/V state and standardized reseed_counter semantics—this yields established forward secrecy on rekey and bounds on prediction after partial compromise.

Designing reseed policy and procedures

• Entropy thresholds: require reseed when accumulated fresh entropy ≥ security_strength bits (e.g., 128/256).
• Event triggers: periodic (time-based), request-count-based, health-test failure, or external event (network compromise).
• Parameters: follow standards—e.g., limit output-per-reseed and reseed intervals (NIST suggests a reseed_counter limit like 2^48 for DRBGs; choose conservative values for embedded or high-risk systems).
• Practical: reseed if either T seconds elapsed OR R outputs produced OR new hardware event; require at least X bits of estimated entropy from independent sources before accepting reseed.

State-compromise recovery

• Detection: monitor entropy source health tests, seed-usage anomalies, and external alerts.
• Immediate steps on suspected compromise:
  • Stop using existing generator output.
  • Gather fresh entropy from multiple independent sources; require conservative min-entropy (exceed security strength).
  • Reinitialize using an extractor (HKDF/HMAC) with fresh randomness and a new unique salt/nonce.
  • If possible, perform forward-recovery: rotate keys derived from the DRBG only after reseeding with entropy that adversary cannot have seen.
• Additional mitigations:
  • Use forward-secure constructions (periodic rekey) so past outputs remain safe after compromise.
  • Keep an immutable audit log of reseed events and entropy estimates.
  • Zeroize internal state on compromise and enforce secure erasure.

Practical recommendations for a cryptographer

• Prefer extract-then-expand (HMAC/HKDF) over raw hash concatenation.
• Use a standardized DRBG for long-lived use and follow NIST/ISO guidance for limits and reseed policies; tune reseed counters conservatively for your threat model.
• Always perform health tests, conservative entropy estimation, and require entropy from diverse, independent sources for reseed.
• Define and document an incident response (stop, gather >security_strength bits, reinit, rotate dependent keys, log).

This approach balances theoretical soundness (provable extraction and PRF security) with operational resilience (reseed, detection, recovery).

High-level goal
Prevent a single malicious key-directory from performing a silent key-substitution by making every key mapping public, auditable, and verifiable across multiple independent directories and transparency logs while preserving scalability and low latency.

Architecture overview

• Multiple independent key-directory servers (D1..Dn) each maintain a mapping: user_id → public_key_version, and append every update to an append-only transparency log (per-directory or shared) implemented as a Merkle tree (CT/RFC6962 style).
• Directories cross-sign each other's Signed Tree Heads (STHs) or use a threshold signing service so no single directory can present a privately forged view.
• Independent monitors/auditors and gossip mesh ensure global consistency and detect equivocation.

Client verification steps

1. Query k directories in parallel (e.g., k=3): receive (public_key, inclusion_proof, STH, STH_signature).
2. Verify inclusion_proof against STH (Merkle inclusion).
3. Verify STH_signature: must be signed either by a quorum (threshold) of directories or cross-signed chain accepted by client root-set.
4. Fetch or obtain a consistency proof between recent STHs (or verify STHs received over time) to detect rollbacks/equivocation.
5. Compare returned public_key across queried directories; if disagreement, treat as alarm and consult monitors/gossip.
6. Optionally verify key fingerprint out-of-band or via prior cached trusted key version.

Gossip & transparency log strategies

• Directories publish STHs periodically; clients and peers gossip STHs and inclusion proofs in a randomized peer-to-peer mesh or via CDNs to amplify detection.
• Monitors continuously re-fetch logs, verify append-only property via consistency proofs, and publish signed accusations if they find equivocation.
• Use probabilistic auditing: monitors sample user mappings and inclusion proofs; auditors can request full-history proofs from directories.
• Use compact cross-logging: directories submit their STHs into each others' logs to create an intertwining graph of attestations that increases the cost of equivocation.

Trust assumptions to preserve

• Client trusts a small, well-known root set of directory public keys or a threshold policy (e.g., at most t of n are malicious). Security holds if at least one honest directory participates in cross-signing or at most t dishonest directories.
• Transparency logs are append-only and support verifiable inclusion and consistency proofs.
• Monitors/gossip peers are independent; at least one honest monitor will publish evidence of equivocation.
• Clients must maintain a small trusted bootstrap (e.g., pinned directory root keys or trusted timestamping).

Scale & latency considerations

• Parallel queries to k directories mitigate added latency; choose k small (2–4) for UX.
• Use CDN caching for inclusion proofs and STHs with short TTL and enforce freshness with signed timestamps and epoch counters.
• Shard directory data (by user-hash ranges) and use Merkle forest or per-shard trees to keep proof sizes small.
• Employ batch updates and compacted proofs (Merkle multi-inclusion) to reduce bandwidth.
• Asynchronous monitoring/gossip decouples heavy auditing from client critical path; clients do lightweight checks and escalate only on anomalies.

Trade-offs

• Stronger threshold/quorum models reduce dependence on any single directory but increase complexity (key management, threshold signature coordination) and slightly higher latency for signing.
• Querying more directories increases assurance but raises latency and bandwidth; use adaptive strategies (query more only on mismatch or riskier accounts).

This design gives cryptographic detectability of silent key-substitution, practical client checks, and scalable mechanisms (sharding, caching, compact proofs) while relying on well-defined minimal trust assumptions (honest threshold or at least one honest cross-signer and honest monitors).

Brief approach
Create reproducible, RFC-driven tests exercising known vectors, boundary conditions, and API misuse paths. Verify ciphertext, tag, and error behavior match RFC 7539 (ChaCha20-Poly1305) and RFC 8452 / RFC 5116 / NIST for AES-GCM.

Concrete tests

• Run all official RFC test vectors: compare ciphertext and tag byte-for-byte.
• Deterministic IV/nonce tests: fixed nonce from vectors.
• AAD-only authentication: plaintext empty, AAD non-empty (vectors exist).
• Plaintext-only: AAD empty, plaintext non-empty.
• Both empty: empty AAD and empty plaintext.
• Long-message tests: maximum nonce/length boundaries per RFCs (2^32/2^64 limits).
• Incremental/streaming API: feed data in many small chunks; final tag must match single-shot.
• Multi-part AAD/pt ordering: interleave AAD and plaintext pieces.
• Reuse-nonce misuse: encrypt two different plaintexts with same key+nonce -> detect duplicate keystreams.
• Associated-data forgery: flip a bit in tag/AAD/ciphertext -> decryption must fail.

API usage patterns to verify

• Single-shot vs update/final produce same tag.
• Explicit tag handling: APIs requiring separate auth-tag buffer vs appended tag.
• Returned error codes on auth failure (not silent).
• Constant-time compare for tag validation (no early-return timing leak).
• Zeroization of keys and internal state on free.

Edge cases

• Empty AAD, empty plaintext.
• Max plaintext lengths (per RFC limits).
• Nonce lengths other than 12 bytes (ensure RFC-defined behavior or reject).
• Tag truncation support: verify allowed truncation lengths and test that truncated tags fail when full required.
• Repeated finalize calls; update after finalize should error.

Red-flag behaviors

• Accepting incorrect tag silently (returns plaintext).
• Different tags between streaming and single-shot.
• Non-constant-time tag compare (timing side-channels).
• Accepting non-12-byte nonces without documented handling.
• Reusing nonce without warning; library auto-incrementing nonces incorrectly.
• Deterministic API that reuses internal nonce state across contexts.
• Memory not cleared; keys left accessible after free.

Reporting
Log vector, key/nonce/AAD/pt/cipher/tag hex, API call sequence, and diff. Include timing checks and memory-scan evidence for zeroization failures.

High-level description
I describe HKDF as a two-stage HMAC‑based KDF: first an entropy-purifying extraction step produces a fixed‑length pseudorandom key (PRK) from variable‑quality input material, then a domain‑separating expansion step derives one or more output keys of requested lengths using that PRK and contextual info.

Inputs

• IKM (Input Keying Material): raw secret (e.g., DH shared secret)
• salt: optional random value used as HMAC key in extract; if absent a zero‑string is used
• info: optional context/application‑specific bytes used in expand for domain separation and binding

Why extract then expand

• Separation isolates entropy normalization (extract) from key derivation policies (expand).
• Extract converts non‑uniform IKM into a strong PRK resistant to biases.
• Expand lets you derive multiple independent keys, with context binding via info, without re-extracting or leaking entropy.

Typical uses in key‑establishment

• After a Diffie‑Hellman exchange I use HKDF-Extract(salt, DH) to get PRK, then HKDF-Expand(PRK, info || counter) to derive encryption, IV, MAC keys, and session subkeys.
• Use different info strings for each purpose to prevent key reuse; include protocol identifiers, role, and transcript hashes for explicit binding.