What is the difference between KDFs for key derivation vs password stretching?

Question

This was mentioned in the comments to another question:

To clarify: This is about key-stretching KDFs. Not the kind for diversifying keys (eg. HKDF)

and

There are two kinds of KDF, the slow, strengthening kind fed by a password(e.g. PBKDF2), and a fast one that only derives secondary keys from a master key(e.g. HMAC). The second one obviously shouldn't be used for password hashing.

Now Wikipedia on HKDF seems to think that it is exactly suitable for things like stretching keys:

2./ To "expand" the generated output or an already reasonably random input such as an existing shared key into a larger cryptographically independent output, thereby producing multiple keys deterministicly from that initial shared key, so that the same process may produce those same secret keys safely on multiple devices as long as the same inputs are utilised.

Basically, what I would like to know is where exactly the differences between these two classes of KDFs lie. They both need to produce random looking output and cannot be invertible.

Answer 1

Deriving multiple keys from a strong source key material (which is what HKDF is for) is not key stretching.

The important bit from from the Wikipedia excerpt is this one:

2./ To "expand" the generated output or an already reasonably random input such as an existing shared key into a larger cryptographically independent output, thereby producing multiple keys deterministicly from that initial shared key, so that the same process may produce those same secret keys safely on multiple devices as long as the same inputs are utilised.

As CodesInChaos' comment on the original post you referenced states, there the two types are "fast" and "slow".

Fast KDFs are designed to securely derive multiple keys from source key material that is already strong, with high entropy. HKDF is one of these.

Key-streching or password-stretching is a term used to indicate the the source key material is weak, or low entropy, and a slow KDF needs to be used to create a key while simultaneously protecting (as best it can) the low entropy source material. PBKDF2 is one of these.

If you attempt to use a fast KDF (like HKDF) with low entropy source material like a password, you create similar problems to those you have with using fast hash functions to protect passwords for authentication. Because passwords are predictable, the ultimate set of hashes (or keys) that will be created from will be much smaller than the full keyspace. A fast KDF would let an attacker test far too many candidates far too quickly, making it much more likely that the correct key will be discovered, and so is not in fact suitable for key-stretching.