thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Advanced

Key Derivation Function (KDF)

Function that derives one or more cryptographic keys from a secret value such as a password or shared secret.

Definition

KDFs include password-based KDFs (PBKDF2, scrypt, Argon2) that add work factor, and extract-and-expand KDFs like HKDF (RFC 5869) that turn a shared secret into multiple session keys. TLS 1.3 uses HKDF to derive its key schedule from the (EC)DHE shared secret.

Example

TLS 1.3 derives separate client and server traffic keys from one handshake secret using HKDF.

Exam tip

Password KDFs are slow on purpose; HKDF is fast and expects a high-entropy input.

Related terms