diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index 06b549b..3ecaebb 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -5233,9 +5233,14 @@
             else
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */
             {
-                /* If no salt was provided, use an empty salt. */
+                /* HKDF: If no salt was provided, use an empty salt.
+                 * HKDF-EXTRACT: salt is mandatory. */
                 if( hkdf->state == HKDF_STATE_INIT )
                 {
+#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
+                    if( PSA_ALG_IS_HKDF_EXTRACT( kdf_alg ) )
+                        return( PSA_ERROR_BAD_STATE );
+#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
                     status = psa_key_derivation_start_hmac( &hkdf->hmac,
                                                             hash_alg,
                                                             NULL, 0 );