Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

From Wikipedia:

In cryptography, a key derivation function (or KDF) derives one or more secret keys from a secret value such as a master key or other known information such as a password or passphrase using a pseudo-random function.

Is there a more formal security definition for what they are and what properties they are trying to guarantee, like ind-cpa security for encryption schemes, or collision resistance for hash functions?

share|improve this question
Hugo Krawczyk has defined HKDF, which is intended to be a practical KDF based on HMAC. He wrote paper on subject: Cryptographic Extraction and Key Derivation: The HKDF Scheme. Because goals of KDF are not often well pronounced, this paper formalizes model for Key Derivation Functions (page 6). The formalized model from this paper could be suitable definition sufficient for your purposes. –  user4982 Apr 16 at 18:40
@user4982 If you could post an abstract of that text together with your link than it would make an excellent answer. –  Maarten Bodewes Apr 16 at 22:15

2 Answers 2

Probably the only thing they need to achieve is Pseudo-Randomness, defined in [GGM1986, §3.1].

KDF does not create more entropy than you gave it, but it avoid weaknesses in your cryptosystem due to patterns if the same key is used repeatedly in several rounds.

share|improve this answer
This is probably not a "more formal security definition" of a KDF. –  Maarten Bodewes Apr 16 at 22:19

A KDF takes as input a good short random looking password which it maybe easily human saved but actually is not uniformly distributed. An attacker may have some partial knowledge of the password. The output of the KDF is a cryptographically secure key, meaning that it is indistinguishable from a random looking bit-string. Following the Real-Or-Random game that is an attacker cannot distinguish whether it receives output from a real random function or it receives the output of the KDF on input of her choice. The goal of KDF is to transform inputs to closely uniform ones.

For the construction of KDF an HMAC can be used which is a PRF. Apart from the password the KDF takes as input the number a rounds that will control the amount of time it will take for somebody to run this KDF and a salt which will drastically increase the computation overhead of an attacker who tries to brute force a bunch of KDF evaluations on multiple passwords.

share|improve this answer
The missing key expansion, the focus on passwords and the fact that it certainly is not formal as requested made me vote down this answer. –  Maarten Bodewes Apr 16 at 22:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.