Key Derivation Functions

A key derivation function (KDF) derives 1 or more cryptographic keys from a secret input value.

Here:

• $S$: input secret, such as a password or a Diffie-Hellman shared secret
• $\text{salt}$: non-secret random value
• $\text{info}$: context label binding the key to its purpose
• $L$: required output length

Raw secrets are unfit as keys directly.

• A DH shared secret is a group element, not a uniformly random bit string.
• A password has low entropy.
• 1 secret must yield several independent keys, such as an encryption key and a MAC key.

Key Derivation Function Properties

A secure KDF satisfies:

• Determinism
  The same inputs always give the same key.
• Pseudo-randomness
  The output is computationally indistinguishable from a uniformly random string, as for a pseudorandom function.
• One-wayness
  The input secret cannot be recovered from a derived key.
• Independence
  Keys derived with different $\text{info}$ values are unrelated. Leaking 1 key reveals nothing about the others.

Key Derivation from High-Entropy Secrets

The input already has enough entropy, but is not uniformly distributed. This is the case for a DH shared secret.

HKDF is the standard construction, built on HMAC with a hash function $H$.

• Extract
  Compresses the input into a uniformly random pseudorandom key. $$\text{PRK} = \text{HMAC}_H(\text{salt}, S)$$
• Expand
  Stretches $\text{PRK}$ into $L$ bytes of output keying material $T = T_1 \| T_2 \| \cdots$. $$T_i = \text{HMAC}_H(\text{PRK}, T_{i-1} \| \text{info} \| i), \quad T_0 = \text{empty}$$

The salt is optional here. A fixed or empty salt is acceptable.

Key Derivation from Passwords

The input has low entropy, so an attacker can guess candidates offline. The KDF must make each guess expensive.

• Salt
  A unique random salt per password defeats precomputed tables and prevents identical passwords from giving identical keys.
• Iteration count
  The hash is applied many times. Each guess costs the attacker the same work as the defender’s 1 derivation, multiplied by the count.

• $c$: iteration count

PBKDF2 needs little memory, so GPUs and ASICs run many guesses in parallel. Memory-hard functions such as scrypt and Argon2 require a large amount of memory per guess, which limits this parallelism.

Key Hierarchy

1 master secret yields separate keys for each purpose by varying $\text{info}$.

Using the same key for encryption and integrity can break the security of both.

Examples:

• TLS derives its session keys from the DH shared secret using HKDF.
• Disk encryption derives its key from a user password using PBKDF2 or Argon2.
• Password storage keeps $\text{KDF}(\text{password}, \text{salt})$ instead of the password.