# Does a key derivation function always generate an even distribution of bits in the resulting key?

I am a student of crypto. During our study course, we went into the AES-128 algorithm. All the examples given used an initial key k, 128 bits and we only briefly touched on the key derivation of PBKDF2. We looked at the key as a series of bits of fixed length and discussed the security and so forth.

If the 128-bit key is generated from a function that takes a password as an input, will the distribution of 0 and 1s across the resulting key k always be random?

Let's say I have a dictionary of 'real' passwords from say a leaked website (a good sample size of say 1M), and put these passwords through a PBKDF2 function and recorded the keys k1, k2, through kn (where n=1,000,0000).

If I were to draw a histogram of frequency of bits 0 through 127 being set or not, if the keys were indistinguishable from random I would expect an even number of bits being set across the board. Picture if you will, balls falling through a matrix and landing in 1 of 128 slots.

My questions are, is that the case? Is it possible to see a skew (i.e. do the resulting keys bunch in one area of the spectrum of bits, maybe a curve of sorts?

My rationale behind asking is that is the resulting keys were to bunch to a particular resulting key type, it would narrow the key space to attack the AES-128 encryption.

Therefore, is it true to say that the AES-128 is only as good as the password derivation function having been used to form the key to begin with? If the resulting keys are poor, the key space would narrow?

• PBKDF2 relies on hash functions running in HMAC mode. Usually hash functions are designed to output (uniformly / pseudo-) random bitstrings. – SEJPM Mar 11 '16 at 12:35

The entire joint distribution of output and input bits for a function that maps $\{0,1\}^a \to \{0,1\}^b$ requires on the order of $2^{a+b}$ memory to store. Clearly it becomes prohibitive to store and sample it for even a small function that maps 32-bits onto another 32-bits through a fixed transformation (i.e., without including any key bits that define a particular permutation).