# Could a key derivation function be used to encrypt data with a weaker key?

To allow the key to be more easily remembered.

Example: To encrypt a hard drive without having a remember a key with 128 bits of entropy.

From what I find they seem mostly used to hash passwords so the password database is more resistant to brute force in the case it's compromised. (compared to using a regular hash function)

So I'm not sure that the use case that I mentioned would be safe.

• Sure you can (and should) apply a strong PBKDF when using passwords. This is standard practice for Full Disk Encryption to recover the full entropy bulk encryption keys. – SEJPM Feb 26 '16 at 20:50

Yes, because this is the entire stated point of password-based key derivation functions (e.g., PBKDF2 or scrypt). The caveat is that more iterations only get you so much; 100,000 iterations is only enough to increase "effective" entropy by a little over 16 bits ($100,000 \approx 2^{16}$) — to match a real 128-bit key, you'd need a password with 112 bits of entropy, which is an impractical 19-character alphanumeric password.