Key derivation function (KDF)

Purpose and main properties

KDFs serve several purposes: they expand or compress secret material into keys of appropriate length, add domain separation so the same secret can safely be reused for different purposes, and increase the cost for an attacker trying to guess the original secret. Important properties include one-wayness (hard to invert), pseudorandomness of outputs, and support for parameters such as salts, iteration counts or memory-cost settings. When processing passwords KDFs often perform key stretching or memory-hard computations to slow brute-force and hardware-accelerated attacks. Common design elements are salts (random nonces), iteration counts, and optional context or info strings.

Types and examples

• Iterated hash-based KDFs such as PBKDF2.
• Adaptive password hashing algorithms like bcrypt and scrypt, which add cost factors and sometimes memory hardness.
• Modern memory-hard designs such as Argon2, created to resist GPU and ASIC cracking.
• Extract-and-expand constructions such as HKDF used to derive multiple keys from a high-entropy shared secret (for example after a Diffie–Hellman agreement).

History and development

Early KDFs were simple iterations of cryptographic hashes. As password-cracking hardware evolved, designers introduced adjustable cost parameters and memory-hard functions to increase the resources an attacker needs. This evolution led from basic iterated hashes to widely adopted standards and newer algorithms that balance performance with resistance to parallel hardware.

Uses and examples

KDFs are used for password storage, key stretching, deriving symmetric keys from master secrets, and producing keys for different protocol roles. For instance a shared secret produced by Diffie–Hellman is typically fed into a KDF to produce session keys used by ciphers such as AES. KDFs also allow a single secret value to yield multiple domain-separated keys (encryption, MAC, IV generation) safely. They are frequently combined with salts and other context data and are referenced in standards and RFCs.

Security considerations and distinctions

Selecting a KDF involves trade-offs: choose parameters that make legitimate use practical but increase attacker cost. Always use a per-secret salt to avoid precomputation attacks and prefer algorithms with adjustable cost or memory parameters. Distinguish KDFs from simple cryptographic hashes or MACs: while related, KDFs incorporate additional structure (salts, iterations, context) and are intended specifically to produce keys. For guidance consult protocol specifications and trusted cryptographic libraries; further resources are available on general cryptography pages and password-handling guides such as those focused on password security.

Further reading

Technical standards and algorithm descriptions provide implementation details and recommended parameter choices. For an introduction to randomness sources and entropy considerations see material on random inputs and entropy estimation. Practical examples and interoperable formats are discussed in many protocol specifications and implementation guides.