阅读中文版本

Key Derivation Functions

A KDF turns a low-entropy secret or a shared secret into one or more strong keys, deliberately slow for passwords and fast for key expansion.

Definition

A key derivation function deterministically derives cryptographic key material from an input secret, with variants tuned either to resist brute force on passwords or to expand existing high-entropy keys.

It is used when storing passwords, deriving per-context keys from a master secret, and turning a shared secret into session keys. Compared to simpler alternatives, this concept fits best when the trade-off it represents is the one the system actually cares about.

When to use it

A common use case is applying it at the boundary where the cost of getting it wrong is highest, and the scenario usually involves a concrete guarantee the system must uphold. Unlike an ad hoc approach, it makes that guarantee explicit, reviewable, and testable.

How it works

Password-oriented functions such as Argon2, scrypt, and bcrypt are deliberately slow and often memory-hard, making large-scale guessing expensive.

Key expansion functions such as HKDF assume input with real entropy and focus on domain separation, letting one master key safely produce distinct keys for different purposes.

Trade-offs and alternatives

Always separate keys by context using an informational string, so a key derived for one protocol cannot be silently reused in another. The main drawback is the extra complexity it introduces, so the benefit should clearly outweigh that cost before a team adopts it.

Common misconceptions

A persistent misconception is that a password hash and a general-purpose KDF are interchangeable. Another is that adding more iterations helps only for password inputs. For example, an engineer who assumes otherwise may design around a guarantee that does not actually exist, which only becomes obvious under load or failure.

Anti-patterns to avoid

Two recurring anti-patterns are to using a fast key expansion function to hash passwords and to deriving many keys by a trivial transformation of one secret. Both tend to surface as hard-to-debug production issues rather than obvious test failures. Related concepts include Public Key Infrastructure, XML External Entity Injection, NoSQL Injection.