Key Derivation Function Reference
Reference for KDFs: HKDF, PBKDF2, scrypt, and KDF security properties.
KDF Properties
A key derivation function derives one or more cryptographic keys from a secret value. KDFs must produce pseudorandom output even if the input has low entropy (passwords). The salt provides independence across contexts and prevents precomputation. Context/info parameters bind derived keys to specific purposes, preventing cross-protocol reuse. A good KDF is extract-then-expand: first concentrate entropy, then expand to desired length.
- pseudorandom
- Output indistinguishable from random
- salt
- Per-context randomization
- info
- Purpose binding
PRF securityprevents precomputationkey separationStandard KDFs
HKDF (RFC 5869) is a fast HMAC-based KDF for high-entropy secrets, used in TLS 1.3. PBKDF2 (RFC 8018) iterates a PRF for password-based derivation, FIPS-standardized but not memory-hard. scrypt combines PBKDF2 with a memory-hard function for stronger password resistance. Modern protocols use HKDF for session key derivation and Argon2/scrypt for password storage. Key separation is achieved by varying the info parameter.
- HKDF
- HMAC-based, fast
- PBKDF2
- Iterated PRF
- scrypt
- Memory-hard KDF
RFC 5869, TLS 1.3RFC 8018, FIPSpassword-based