> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/server/reference/sql-functions/secondary-functions/encryption-hashing-and-compression-functions/kdf.md).

# KDF

{% hint style="info" %}
`KDF()` is a key derivation function available from [MariaDB 11.3.0](/docs/release-notes/community-server/old-releases/11.3/11.3.0.md).
{% endhint %}

## Syntax

```bnf
KDF(key_str, salt [, {info | iterations} [, kdf_name [, width ]]])
```

## Description

`KDF` is a key derivation function, similar to OpenSSL's EVP\_KDF\_derive(). The purpose of a KDF is to be slow, so if the calculated value is lost/stolen, the original `key_str` is not achievable easily with modern GPU. KDFs are therefore an ideal replacement for password hashes. KDFs can also pad out a password secret to the number of bits used in encryption algorithms.

For generating good encryption keys for [AES\_ENCRYPT](/docs/server/reference/sql-functions/secondary-functions/encryption-hashing-and-compression-functions/aes_encrypt.md) a less expensive but cryptographically secure function like [RANDOM\_BYTES](/docs/server/reference/sql-functions/secondary-functions/encryption-hashing-and-compression-functions/random_bytes.md) is recommended.

* <kbd>kdf\_name</kbd> is "hkdf" or "pbkdf2\_hmac" (default).
* Width (in bits) can be any number divisible by 8, by default it's taken from @@block\_encryption\_mode.
* Iterations must be positive, and is 1000 by default.

Note that OpenSSL 1.0 doesn't support HKDF, so in this case `NULL` is returned. This OpenSSL version is still used in SLES 12 and CentOS 7.

## Examples

```sql
select hex(kdf('foo', 'bar', 'infa', 'hkdf')); 
+----------------------------------------+
| hex(kdf('foo', 'bar', 'infa', 'hkdf')) |
+----------------------------------------+
| 612875F859CFB4EE0DFEFF9F2A18E836       |
+----------------------------------------+
```

<sub>*This page is licensed: CC BY-SA / Gnu FDL*</sub>

{% @marketo/form formId="4316" %}