feat(jose): add deriveKey and createDeriveKey functions for HKDF key derivation

[halvaradop]

Description

This pull request introduces the deriveKey and createDeriveKey functions, enabling HKDF-based key derivation for secret keys used in signing and encryption operations within the @aura-stack/jose package.

With this change, all cryptographic utilities exported by the package now accept derived keys, allowing users to provide any base secret from which a secure cryptographic key can be generated using HKDF.

Why HKDF?

HKDF (HMAC-based Key Derivation Function) enhances security by deriving strong, uniform, and application-specific keys from an initial secret. This approach provides an additional security layer by ensuring that:

• The original secret is never used directly for signing or encryption.
• Even if an attacker intercepts or obtains the base secret, the derived keys remain protected through HKDF’s one-way derivation.
• Applications can safely generate multiple independent keys from a single secret.

Related RFCs

• HMAC-based Extract-and-Expand Key Derivation Function (HKDF)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
auth	Ready	Preview	Comment	Nov 26, 2025 2:26am