KBKDF Key Derivation

KBKDF_Derive is the most configurable - and easily the most intimidating - key derivation node in this pack. KBKDF (Key-Based Key Derivation) comes from NIST SP 800-108, and its counter mode works by repeatedly hashing a counter plus fixed data until enough bytes come out. Where HKDF is "give it a secret, get a key," KBKDF is "specify the counter width, its placement, the label, the context, and whether you want HMAC or CMAC underneath." It's the node you reach for when you need to match an exact key-derivation recipe - usually to interoperate with some existing system - rather than when you just want a key.

What all the inputs mean

The core KDF inputs are the familiar trio: message (BYTESLIKE, the input key material), length (16–256 bytes), and algorithm (the hash, 15 choices). Then it gets interesting:

• operation_mode - KBKDFHMAC (HMAC-based, the sane default) or KBKDFCMAC (CMAC-based, using AES - only sensible if you specifically need CMAC).
• rlen and llen - the byte widths of the binary counter (rlen) and its length prefix (llen). Both default to 4 and are the "why is this even exposed?" fields of the node. You change them only to match an external specification; for everything else, leave them alone.
• location - where the counter bytes go: BeforeFixed, AfterFixed, or MiddleFixed. BeforeFixed (default) is the common case.
• break_location - only used with MiddleFixed: the byte offset inside the fixed data where the counter lands. Default 0.
• label and context - application-specific BYTESLIKE fields, the NIST-sanctioned way to bind the derived key to a purpose and a usage context.
• fixed - an alternative: instead of separate label and context, you can supply one blob of fixed data. The tooltip is explicit: if fixed is set, label and context are ignored.

The output

• derived_key (BYTESLIKE) - the derived key bytes, wired into whatever consumer wants them.

Installing it

Part of the ComfyUI ARG Toolkit:

cd ComfyUI/custom_nodes
git clone https://github.com/AzelusLightvale/ComfyUI-ARG-Toolkit

Restart ComfyUI, or install via ComfyUI Manager ("ComfyUI ARG Toolkit") - cryptography provides the KBKDF implementation.

Where people get burned

• Over-configuring for no reason. Every one of rlen, llen, location, break_location, label, context is a chance to produce a key that doesn't match the other side. If you don't have an external spec to match, you shouldn't be touching half of these - and honestly, you probably shouldn't be using KBKDF at all. HKDF does the same job with a tenth of the knobs.
• fixed vs label/context. Setting fixed silently disables the other two. If you wire up all three expecting them to combine, you'll get the fixed-only derivation and wonder where the label went.
• Mismatched recipe, silent False. Unlike the derive nodes, there's no error when the recipe differs from what the verifier expects - you just get a key that doesn't match downstream.

Reach for KBKDF_Derive when a puzzle or system hands you a spec with "NIST SP 800-108" in it and you have to reproduce its exact output. For the 99% case - derive a key from a shared secret and move on - the pack's HKDF node is the one you'd actually reach for. This one is the specialist's tool, powerful, precise, and overkill for almost everything.