🧩Key Derivation Function

NEW

Also known as: KDF

A cryptographic function that derives one or more keys from a secret input, often adding salt and iteration to resist brute-force attacks.

DESCRIPTION

Key derivation functions transform an initial secret (password, master key, or shared secret) into one or more cryptographic keys. Password-based KDFs (e.g., PBKDF2, scrypt, Argon2) add salt and computational or memory cost to resist offline attacks. Extract-and-expand KDFs such as HKDF derive keys from high-entropy sources. Proper parameterization (iterations, memory, parallelism) and unique salts are essential. KDFs underpin password storage, key hierarchy construction, and session key derivation.

ALTERNATIVE DEFINITIONS

Wikipedia

In cryptography, a key derivation function (KDF) is a cryptographic algorithm that derives one or more secret keys from a secret value such as a master key, a password, or a passphrase.

Highlights multi-key derivation from various secret inputs.

Source

NIST SP 800-108

This Recommendation specifies techniques for the derivation of additional keying material from a (master) key using pseudorandom functions.

Focuses on PRF-based key derivation for key hierarchies.

Source

RELATED TERMS

Password-Based Key Derivation Function 2 scrypt Argon2 HKDF bcrypt Salt Pepper Password Hashing Key Stretching Entropy

COMPETING TERMS

Hash Function

RELATIONS

• Narrower: Argon2

KNOWLEDGE AREAS

Data Security Mathematics

TARGET AUDIENCE

Security Architect Cybersecurity Engineer Software Developer MLOps Engineer

EXTERNAL SOURCES

• Wikipedia - Key derivation function
• IETF RFC 5869 (HKDF) - HKDF specification and rationale.
• IETF RFC 8018 - PBKDF2 standard within PKCS #5.
• NIST SP 800-63B - Guidance on storing memorized secrets.

TOP QUESTIONS

Why use a Key Derivation Function instead of a hash?

KDFs add salt and computational or memory cost, making offline guessing significantly harder than simple hashing.

Category: Relevancy

What parameters matter in a KDF?

Iterations (work factor), memory cost, parallelism, salt length, and output key length drive security and performance.

Category: Requirements

When should I use HKDF?

Use HKDF to derive multiple keys from high-entropy secrets in protocols and key hierarchies; it is not a password hashing function.

Category: UseCases

How do scrypt and Argon2 resist attackers?

They are memory-hard, making specialized hardware attacks costly and less efficient than CPU-bound approaches.

Category: Concepts

How often should KDF parameters be updated?

Re-evaluate periodically as hardware improves; increase work factors or migrate to memory-hard KDFs as needed.

Category: Management

Can a KDF derive multiple keys safely?

Yes, with proper context separation (info labels, different salts) to prevent key reuse vulnerabilities.

Category: BestPractices

What mistakes occur with KDF implementation?

Reusing salts, underestimating work factors, and misusing KDFs for password storage or protocol keys interchangeably.

Category: Mistakes

Is peppering relevant to KDFs?

Yes. A pepper stored separately can add an extra barrier if the database is compromised.

Category: Concepts

Where to learn more about KDFs?

Study RFCs 5869 and 8018, NIST SP 800-108, and OWASP password storage guidance.

Category: GettingStarted