How to select salt an IKM for HKDF I have an application where I need to combine a Diffie-Hellman shared secret, with a user's password and derive a key. I'm investigating the possibility of using HKDF to as follows


Initial Keying Material(IKM)= DHE-shared-secret and 
salt                        = password-utf-8-bytes 


I choose this because the DHE-secret is larger and, has more entropy than the password bytes. Is this correct or should it be the other way around?
I'd say that if you'd use HKDF as it is supposed to, then you should concatenate the two the concatenated result as Input Keying Material (IKM). HKDF has an extract first which will compress the IKM so you can input as much keying material as required.

You should of course make sure that it is impossible to have collisions for concatenated secret and password pairs. This is easily accomplished by making sure that the DH secret is constant sized (which is best practice anyway).

It is always possible to later add an actual salt; a password is not unique across invocations and therefore it is unsuitable to be a salt. You may want to add a salt later to reach a higher security level and leave it empty for now.

You may want to first perform a password hash over the password and include the result in the HKDF calculation. The reason for that is that currently the other party of the key agreement must know the password in advance. It is better to store a password hash in case the other other party gets compromised.

With that in mind you may also be interested in SRP and other augmented PAKE protocols.