Derived Key Of Empty

A cryptographic key-derivation routine returns a deterministic, publicly-computable value when its input is the empty string: PKCS#7 of zero bytes is the padding count repeated, HKDF with empty IKM collapses to a function of the salt, constant-key constructions substitute an empty parameter for a hardcoded default. The caller trusts whatever bytes emerge without checking that the derivation had an actual key to work from. The attacker's work is to find the code path that feeds the derivation an empty string.