Can someone clarify two things about the HKDF by Krawczyk?
For example, there are no current attacks to HMAC-MD5, although MD5 is broken for several years. Hash functions have very strong requirements (e.g., collision resistance, preimage resistance, etc.), and some hash functions have been shown to fail some of these requirements (e.g., MD5 is not collision resistant). Hash-based KDFs may be affected by the problems of these hash functions, since they directly use their output, normally a concatenation of iterated inputs. On the contrary, HKDF only requires that the compression function behaves like a PRF, which is a much weaker assumption.

See these other questions for more details:

Is HMAC-MD5 considered secure for authenticating encrypted data?

Security of KDF1 and KDF2 (hash based KDF&#39;s)