What is Key Derivation Function?
A cryptographic function that derives one or more secret keys from a master secret, password, or other source of entropy. KDFs add security through computational cost and produce keys of the required length and format.
Also known as: KDF, Key Stretching
Key Derivation Functions transform weak input (like passwords) into strong cryptographic keys. They're designed to be intentionally slow, making brute-force attacks impractical.
Why Not Just Hash?
A simple hash is too fast:
- Modern GPUs can compute billions of SHA-256 hashes per second
- Short passwords can be cracked quickly
- KDFs add intentional slowness
Types of KDFs
Password-Based KDFs
Designed for human-chosen passwords:
- Argon2: Modern winner, memory-hard
- bcrypt: Time-tested, widely used
- scrypt: Memory-hard predecessor to Argon2
- PBKDF2: Older but still acceptable
General-Purpose KDFs
For deriving keys from good entropy:
- HKDF: Extract-and-expand paradigm
- Used when input already has high entropy
Argon2 (Recommended)
Winner of the Password Hashing Competition:
Variants
- Argon2d: Maximum resistance to GPU attacks
- Argon2i: Resistant to side-channel attacks
- Argon2id: Hybrid, recommended for most uses
Parameters
- Memory: Amount of RAM required
- Iterations: Time cost
- Parallelism: Number of threads
How KDFs Protect Passwords
User password: "cat123"
Without KDF:
SHA256("cat123") → cracked in milliseconds
With Argon2 (100ms per attempt):
Argon2("cat123", salt, params) → 10 guesses/second max
At 10 guesses/second:
- 1 million passwords = 27 hours
- 1 billion passwords = 3 years
Key Stretching Parameters
Time Cost
- How long each derivation takes
- Balance security vs user experience
- Login: 100-500ms acceptable
- Encryption: can be longer
Memory Cost
- RAM required per derivation
- Defeats GPU/ASIC attacks
- GPUs have limited memory per core
Parallelism
- CPU threads used
- More threads = faster on multi-core
- But also more resources for attackers
Best Practices
- Use Argon2id for new applications
- Tune parameters for ~100-500ms on target hardware
- Re-hash stored passwords when upgrading
- Use unique salt per password
- Never roll your own KDF
Related Terms
Hash Function
A mathematical function that converts any input data into a fixed-size string of characters (hash). Cryptographic hash functions are one-way, meaning you cannot reverse the process to recover the original data.
Password Manager
Software that securely stores and manages passwords and other credentials. Password managers generate strong, unique passwords for each account and encrypt them with a single master password, eliminating password reuse and the need to remember multiple complex passwords.
Salt
Random data added to a password before hashing to ensure identical passwords produce different hashes. Salting defeats rainbow table attacks and prevents attackers from identifying users with the same password.
Have more questions?
Use our guided flow to get the right next privacy step for Key Derivation Function.
Open Guided Flow