Can we have single hash function both for data integrity and key derivation function? Why and Why not? Any link describing difference analytically will be appreciated. Thanks.
I'll answer the question in the context of the most common application of KDFs - Password-Based Key Derivation Functions (ex PBKDF2) which take a relatively low-entropy string and derive a key from it. As opposed to Key-Based KDFs which take something that's already a strong key and change its length.
Hashes and PBKDFs are designed for different things. Yes, they are both hash functions with all the usual collision resistance, pre-image resistance, etc, but:
- General-purpose hash functions want to be fast to have efficient implementations in software and hardware. This greatly reduces the runtime costs and latency of TLS servers, embedded devices doing TLS, hashing large files, etc.
- PBKDFs want to be slow to make it as frustrating / expensive as possible to perform brute-force attacks on the password or master key.
SHA2 makes a terrible PBKDF because it's way too fast. PBKDF2 makes a terrible hash function because it's way too slow.
Many key derivation functions use regular hash functions internally.
For example, if you take a look at the PBKDF1/2 spec in RFC 2898, you'll notice:
PBKDF1 applies a hash function, which shall be MD2 , MD5  or SHA-1 , to derive keys.
PBKDF2 applies a pseudorandom function (see Appendix B.1 for an example) to derive keys.
And the example referenced in Appendix B.1 is to use
HMAC-SHA-1 as the underlying pseudorandom function.
Related question on security.SE:
Well, yes, kind of.
First of all, a cryptographically secure hash only provides limited amount of data integrity. You'd have to know and trust the hash value in advance for it to work. A great example are downloads of software through mirrors. If the software hasn't actually been signed then the main site can host the hashes over the files while you can download the files by using the mirrors. Then you can calculate the hash and compare. Now if the file was altered on the mirror then the hash verification will fail: you'll get different values.
Now a hash is somewhat less problematic as "poor man's key derivation function". Note that hashing passwords instead of keys - as I presume the question implies - using a cryptographically secure hash will generally not create a secure key and may result in an adversary learning the password as well.
Now generally for both situations we can use a keyed hash. HMAC is probably the most well known keyed hash. If a keyed hash is used then yes, we can use a hash for both situations. Obviously it is now required to first agree upon a secret key to use. But after that you can use the same keyed hash to protect the integrity of the data and to perform key derivation.
In general two keys are used, one for each functionality. If that's not the case it will be tricky to prove that the scheme is secure. It is however perfectly fine to use the same hash algorithm as configuration parameter of the HMAC function.
Although HMAC is often used directly as KDF - for instance in TLS - it should really just be used as configuration parameter for a real KDF such as HKDF.