3 ms·
This is inaccurate and borderline dangerous advice. The output of a KDF does not contain more entropy than the input. You cannot "create" entropy with a KDF.
by admax88qqq 5y ago
This is inaccurate and borderline dangerous advice.
The output of a KDF does not contain more entropy than the input. You cannot "create" entropy with a KDF. Sure it _looks_ random, but no actual randomness was added during the process.
A KDF adds some security against brute force attacks by making them more expensive, but it does not add entropy, it does not increase the search space of a brute force attack.
- omoikane 5y agoSee also: https://en.wikipedia.org/wiki/Key_stretching https://en.wikipedia.org/wiki/Key_stretching