Can someone clarify two things about the HKDF by Krawczyk? I got a question about the HKDF Scheme by Hugo Krawczyk. On the following link you can find a small explanation of the HKDF-Scheme and some short informations. The HKDF specification itself has been published as RFC 5869.

I got two questions about the short informations. It is said that: 



  Research results obtained in recent years point out to the advantages of building KDF functions based on HMAC rather than on plain hash functions as traditional schemes do.


What are the advantages? What is exactly meant by that?

  In particular, these results show that an HMAC-based KDF can be founded on weaker assumptions on the underlying hash function
  …
  Based on such results we propose HKDF, a fully-specified HMAC-based KDF, that can serve multiple applications under a wide variety of requirements and under relaxed assumptions on the hash functions.


What assumptions are exactly meant?


It would be very nice if someone can give me some short explanations or some thoughts.
For example, there are no current attacks to HMAC-MD5, although MD5 is broken for several years. Hash functions have very strong requirements (e.g., collision resistance, preimage resistance, etc.), and some hash functions have been shown to fail some of these requirements (e.g., MD5 is not collision resistant). Hash-based KDFs may be affected by the problems of these hash functions, since they directly use their output, normally a concatenation of iterated inputs. On the contrary, HKDF only requires that the compression function behaves like a PRF, which is a much weaker assumption.

See these other questions for more details:

Is HMAC-MD5 considered secure for authenticating encrypted data?

Security of KDF1 and KDF2 (hash based KDF&#39;s)