KDF
also: Key Derivation Function
A Key Derivation Function (KDF) is a cryptographic algorithm that derives one or more secure encryption keys from a password or master key by applying mathematical transformations and adding computational cost.
A Key Derivation Function (KDF) solves the problem that user passwords are typically weak and unsuitable for direct use as cryptographic keys. A KDF takes a password (or other secret) and transforms it into a cryptographically strong key through repeated hashing, salting, and other operations.
Common Linux KDFs include PBKDF2, bcrypt, and Argon2. These functions intentionally add computational overhead, making brute-force attacks prohibitively expensive. For example, when you set a Linux user password with passwd, the system uses a KDF to derive a hash stored in /etc/shadow, rather than storing the password itself.
KDFs are essential for disk encryption tools like LUKS, password managers, and TLS/SSH key generation. The "work factor" parameter lets administrators tune the computational cost: higher values slow down attacks but also legitimate logins slightly.