ConcatKDF (HMAC) Key Verification

ConcatKDFHMAC_Verify is the checking counterpart to ConcatKDFHMAC_Derive: feed it the same derivation inputs - including the salt - plus an expected_key, and it tells you whether that key is what the derivation actually produces, as a clean boolean. Where the Hash variant's verify gives you "does the derivation match," this one answers the same question for the salted, HMAC-based variant. In an ARG mechanic where "prove you know the secret" means deriving a key correctly, this is the node that turns a guess into a pass/fail without you manually comparing hex strings.

It inherits the entire ConcatKDFHMAC_Derive input set and adds one input, which makes it the easiest node in the KDF family to reason about: everything the Derive node takes, plus expected_key; and instead of derived_key out, you get verified_status (a boolean). Same source-class family, one line of intent changed.

How it works

It wraps cryptography's ConcatKDFHMAC.verify(), which re-runs the derivation (same message, length, algorithm, salt, and other_info) and compares the result to expected_key. A mismatch returns False; a match returns True. There's one edge case to know about: if the underlying verify object gets finalized more than once - which the library forbids - the pack raises a RuntimeError telling you verification was called twice on a finalized KDF. In normal use that's not something you'll trigger; it's the pack surfacing a library constraint rather than hiding it.

The inputs that matter

• message - the raw shared secret, in bytes.
• length - derived key length in bytes (default 32, 16–256 in 16-byte steps).
• algorithm - the hash inside the HMAC; must match the Derive side.
• salt (optional) - the salt bytes used at derivation; must match exactly.
• other_info (optional) - context bytes; must match.
• expected_key - the key to check, as bytes.

Output: verified_status, a boolean - wire it to a routing node or a BooleanOutputter to render "PASS"/"FAIL" for readability.

Installing it

Part of the ComfyUI ARG Toolkit pack. Install via ComfyUI Manager (search "ComfyUI ARG Toolkit") or:

cd ComfyUI/custom_nodes
git clone https://github.com/AzelusLightvale/ComfyUI-ARG-Toolkit

Restart ComfyUI. Powered by the pack's cryptography dependency (plus secretpy, stegano, invisible-watermark, reedsolo, and transitive torch/opencv-python). No models, no API keys.

Gotchas

The salt is the extra thing to get wrong here that the Hash variant doesn't have: a mismatched salt between derivation and verification produces a False even with the right secret. And keep the broader rule in mind - length, algorithm, and other_info must all match the derivation too, so a False is often "parameters don't line up" rather than "wrong key." Line up every dial, and the boolean is trustworthy.