Are there any authoritative definitions of "key stretching"?

Question

This is mostly a terminology question, but I suppose that it is best asked and answered here. After browsing the Internet I have come across a fair number of completely different definitions of the term "key stretching" and would like to know if there is any consensus in the research literature about how the term is to be used, or, perhaps, that it should be avoided exactly because there is no consensus.

Some of the meanings:

1. Key stretching is the method of applying a KDF or PRF to some input, as to produce output of arbitrary length. Some uses RFC 5931, gnu.org. The same feature is called key expansion in e.g. RFC 5869.
2. Stretching the entropy of the input by increasing the complexity of the derivation process. Found this on Wikipedia and in this paper by the reputable authors Bruce Schneier, David Wagner et.al. However, it seems these authors intended this feature should be used in particular when there is a need for the first feature (key expansion).
3. Increase the length of the input, e.g. by concatenating it with a public salt, before applying the KDF to it. Both this feature and the second is allegedly sometimes called Key Strengthening.

Are there any better terms that are more likely to be understood correctly without having to repeat the definition each time they are used? Key Expansion for the first, Key Hardening for the second, and Salting for the third?

On the other hand, the term key expansion seems to also often be used to describe the feature of cipher algorithm key schedules, when the input key is expanded into the round keys. It would be better to have a term that distinguishes between the output of a KDF and the intermediary output of a key schedule.

Answer 1

In my practice (Smart Cards, often using DES and increasingly AES)

• Key Expansion is often used to designate production of subkeys in a block cipher. This process is often a mere bit extraction, as part of the algorithm's Key Schedule.
• Key Diversification is, almost exclusively, the process of producing a device key from its serial number (or other identifier) and a master key. This transformation must be such that compromise of the key of some devices does not compromise the master key, or the key of other devices.
• Key Derivation is a general term for producing a key from another key. It is often used for Key Diversification, or the process of expanding one key to several keys of different function (e.g. a confidentiality key for CBC encryption, and an integrity key for CBC-MAC), or the process of obtaining a session key from a long-term key. The term Key Derivation tends to imply that the derived key does not leak from the original key (as illustrated in Key Diversification).

Further, I would understand Key Strengthening or Key Hardening (exclusively), or Key Stretching (less specifically) as a purposely compute-intensive transformation of a key, effectively increasing its resistance to brute force search by a parameterizable factor, e.g. in PBKDF2 or Scrypt. Key Stretching is attested in this meaning, as stated in the question. But I have also seen Key Stretching used for the process of obtaining several keys from a single one, without intend to slowdown a brute force search.

And I would understand Key Salting as the ages-old process of adding (public or mildly secret) salt to a key (of low-entropy such as a password), so that at least identical keys do not degenerate into identical cryptograms, without indication of the deliberate introduction of a compute-intensive transformation as in Key Strengthening.

I am not an authority, English is my second language, and I have somewhat changed my mind on the usual meaning of Key Stretching.