Glossary
Key derivation function (KDF)
A key derivation function turns a password into a cryptographic key through a deliberately slow, often memory-hard process, making each guess costly to test.
A key derivation function (KDF) derives a fixed-length cryptographic key from a password, typically to encrypt data or to produce a value safe to store for later verification. Unlike a raw hash function, a KDF is built to be slow on purpose: it repeats its internal computation thousands or millions of times, or forces heavy memory use, so that computing it once for a legitimate login is unnoticeable but computing it billions of times for an attack is not.
bcrypt, sha512crypt and Argon2 are all KDFs built for password storage; PBKDF2 and the key-stretching steps inside RAR5 and 7-Zip archive encryption are KDFs built to turn a password into an encryption key. Despite the different purposes, the design goal is the same — see Argon2 vs bcrypt vs scrypt for how the major password-storage KDFs compare.
The iteration count or cost parameter is what separates a KDF from a fast, single-pass hash like MD5: it is the deliberate design choice that makes brute force expensive rather than free, which is the whole argument behind why fast hashes are dangerous.