Key derivation function (KDF)

What it means

A key derivation function, or KDF, takes some input secret and produces one or more keys of a fixed size. The input may be a password, a shared secret from a key exchange, or another key. The output is suitable for use as an encryption key or as a stored password check.

There are two main families. Password-based KDFs, such as PBKDF2, scrypt and Argon2, are deliberately slow, because the input is a weak human-chosen secret. Others, such as HKDF, are fast and used to expand a secret that is already strong into several separate keys.

Why it matters

Passwords and keys are different things. A password is short and guessable, while an encryption key is a fixed-length random-looking value. A KDF bridges the gap, and a weak KDF makes the bridge easy to cross for an attacker who has stolen your data.

Choosing badly shows up after a leak. A fast general-purpose hash lets an attacker test billions of guesses per second. A slow, tuned KDF cuts that to a trickle, which is the difference between a breach that exposes a few weak accounts and one that exposes most of them.

How it shows up

You meet KDFs in password storage, in encrypted backups and disk encryption where a passphrase protects a key, and in protocols that expand a shared secret into session keys. In each case there are parameters: a unique salt, a cost setting, and the output length.

The mistakes repeat. Using a plain fast hash instead of a password KDF. Setting the cost low and never raising it. Reusing the same salt. Deriving keys from a password without any KDF. Pick a recommended algorithm such as Argon2, bcrypt or PBKDF2, follow current guidance on settings, and plan to raise cost over time.