Deriving 2 keys using HKDF I have an encryption scheme that uses a 256-bit master key, from which 2 separate keys (one for AES-256-CTR encryption and one for a HMAC-SHA256) are derived using HKDF. However, I'm not sure exactly how to utilize HKDF without screwing it up, so straight to my concerns:


Is it safe to just use SHA-512 as the hashing algorithm to get a 512-bit output and split it in 2?
I know that using salt is not mandatory, but does using it actually improve security?
I know this might be a dumb idea, but still ... can the salt be the IV used for encryption?
Although the answer is already accepted, I'll add an answer with a different look on things.


It's safe, but that's not what HKDF-expand should be used for. The idea of HKDF-expand is to call it twice, once for each key, using the info element to distinguish between the two (e.g. info could be an ASCII encoding of the key name). Note that HKDF should have a relatively short running time.
Although it is not required, it is best to use a salt. So unless there is some important reason not to, use a salt. For KBKDF's a salt is unusual, but the authors seem to think it is important; see the quote underneath this answer.
You could, however I would urge you to independently generate it using HKDF-expand, see answer (1).




Quote for part #2 (see 3.1 of the RFC):


  We stress, however, that the use of salt adds significantly to the
     strength of HKDF, ensuring independence between different uses of the
     hash function, supporting "source-independent" extraction, and
     strengthening the analytical results that back the HKDF design.