# Key derivation function in theory & practice

I am implementing a cryptographic protocol and I'd like to generate a set of seeds using a seed for a pseudo-random function. The reason is that I can pass on only one seed and it can be used to generate the other seeds.

As we know each derived seed is used to generate a set of pseudo-random values.

According to pseudo-random function definition, the seeds must be truly random (and not pseudorandom). So if I use a master seed to generate some other seeds the derived seed would not be truly random (according to the definition).

Question 1: How can I fill the above gap (i.e. satisfy the pseudorandom function) and have a secure key derivation function?

Question 2: Are the key derivation functions deterministic (i.e. given a master key it always generates a set of derived keys)?

• You don't need truly random inputs to KDFs. "Highly unpredictable" suffices. As for the KDFs, Argon2 for low-entropy master secrets and HKDF for high entropy master secrets. And yes all KDFs need to be deterministic (or how would the other party derive the same key?), although you can tweak them via salts and sometimes context information. Nov 20, 2015 at 15:14
• @SEJPM Here is my question, when we feed them with salts, how we would get the same key (with different salt)? Do parties need to exchange salts and master key? Nov 20, 2015 at 15:19
• yes, in this case the parties would secretly exchange master keys (pre-shared? DH?) and then publicly transport salts. Nov 20, 2015 at 15:25
• @SEJPM Ok thank you. I was gonna use it to reduce communication cost (i.e. instead of sending a set of seeds I could send only one master seed). But , apparently it wont help. Nov 20, 2015 at 15:27
• you could use the context info to derive different keys from one secretely exchanged master key (and just ignore the salt) Nov 20, 2015 at 15:31