key derivation function
A key derivation function (KDF) turns one secret — a password, a wallet seed, or a shared Diffie–Hellman value — into one or more cryptographically strong keys. It does two distinct jobs: stretch weak, low-entropy secrets so they resist guessing, and expand or diversify a high-entropy secret into many independent subkeys.
Password KDFs deliberately burn time and memory so that brute-force guessing becomes expensive. PBKDF2 iterates an HMAC tens or hundreds of thousands of times; scrypt and Argon2 additionally demand large memory to defeat GPU and ASIC crackers that parallelize cheaply. Key-expansion KDFs like HKDF use an extract-then-expand design over HMAC to derive context-separated subkeys from an already-uniform master secret. A salt — a unique random input — defeats precomputed rainbow tables and ensures two users with the same password derive different keys.
Wallets lean on KDFs heavily. BIP-39 runs the mnemonic through PBKDF2-HMAC-SHA512 with 2048 iterations and the salt 'mnemonic' plus an optional passphrase to produce the 512-bit seed. Ethereum keystore files encrypt the private key under a scrypt- or PBKDF2-derived key from your password. The iteration count and memory cost are a moving target: they must rise as hardware speeds up, to keep brute force expensive for years to come.
A KDF's slowness is a feature for passwords (it raises the attacker's cost) but a liability if applied per-operation. Use PBKDF2, scrypt, or Argon2 for low-entropy secrets, and HKDF for already-random ones. Never stretch a password with a single plain fast hash.