# Key Derivation Functions offering better than 2^hlen security?

On page 21 of his HKDF paper, Krawczyk criticized one of the stated desirable features of KDFs from the paper On The Security of Key Derivation Functions (Emphasis mine):

Due to the way the hash function is used by these schemes, their strength (measured by the work factor it takes to guess the output of the KDF) is never more than $2^k$ where $k$ is the output length of the hash function, and this is the case even when the entropy of the source key material is (much) larger than $k$. Indeed, in these schemes it suffices to guess $Hash(SKM)$ to be able to compute all the derived key material. While we agree with this fact, we do not agree with the criticism. If a work factor of $2^k$ is considered feasible (say $2^{160}$) then one should simply use a stronger hash function. Counting on a $2^k$-secure hash function to provide more than $2^k$ security, even on a high-entropy source, seems as unnecessary as unrealistic.

This seems like good advice in general: If you want a KDF with a strength larger than $2^k$, then make sure the output length length of your hash is greater than $k$. (You should also, of course, make sure the SKM is stronger than $2^k$)

However, in some highly constrained environments the use of a hash with a larger output length (Like SHA512) is computationally infeasible due to a lack of a hardware implementation, such is the case on many smart cards.

Is there any formally-defined KDF which allows for an output strength larger than $2^{hlen}$ (where $hlen$ is the hash output length), while only using a common hash function like SHA1 or SHA256?

• The question is: why do you need a key strength > 256 bits in the first place. – Maarten Bodewes Oct 18 '17 at 0:24
• What are you providing in input to your KDF ? – Ruggero Oct 18 '17 at 8:37
• "The question is: why do you need a key strength > 256 bits in the first place." Irrelevant for the purposes of this question. This is a question of theory, not about implementation appropriateness. – darco Oct 19 '17 at 1:40
• "What are you providing in input to your KDF ?" Shouldn't matter, but assume it is high-quality output from a whitened, physics-based random number generator. – darco Oct 19 '17 at 1:42