Key derivation function (KDF)
In cryptography, a key derivation function (KDF) turns a password or shared secret into a cryptographic key, and for password storage it is deliberately slow and memory-hard so that guessing is expensive. It is the control that actually resists cracking, and the entry that repairs the incorrect hash-function advice and the outdated salt advice, because both point here.
How it works
A key derivation function takes a low-entropy input, typically a password, plus a salt, and produces a key or a verifier through a process that is intentionally costly. That cost is the whole design. A general-purpose hash function is fast, which is a virtue for integrity and a disaster for passwords; a password KDF such as Argon2id, scrypt, bcrypt or PBKDF2 is tuned so that computing it once is trivial for the server but computing it billions of times is expensive for an attacker. The strongest options are memory-hard: they force each guess to consume a set amount of memory, which defeats the cheap parallel hardware an attacker would otherwise use. The cost parameters are configurable and are meant to be raised as hardware improves.
What goes wrong
The failure is using a fast hash where a KDF belongs, which turns a stolen database into a fast brute-force exercise. On the systems we audit, “salted SHA-256” and bare MD5 are still common for stored passwords, and both fall quickly regardless of the salt. Two subtler failures also recur: cost parameters set once and never increased, so a KDF chosen years ago no longer imposes real cost on current hardware, and PBKDF2 with an iteration count far below what is now appropriate. The point of a KDF is to make each guess expensive, and a KDF configured too cheaply is only nominally protecting the passwords.
Where this shows up in an audit
Wherever passwords or key-from-password derivation appears, we record which function is used and its cost parameters, and whether those parameters have been raised since the system was built. A fast general-purpose hash is a finding on its own; a real KDF with cost set too low is a finding too. The same reasoning appears offensively in kerberoasting, where a weak account password falls to offline cracking precisely because no memory-hard cost stands in the way. We recommend a memory-hard function such as Argon2id with parameters sized to current hardware.