How can a block cipher be used as a pseudorandom function (PRF) or for key derivation (KDF)?

By encrypting a counter or label with a secret key, a block cipher can generate pseudorandom output suitable for deriving multiple keys from a single master key.

* A KDF splits one master secret into separate purpose-specific keys, giving domain separation. *

Block cipher as PRF:

$$\text{Output}_i = E(K, i) \quad\text{(encrypt counter values } 0, 1, 2, \dots\text{)}$$

This produces a sequence of pseudorandom blocks, similar to CTR mode but used for key generation rather than encryption.

Key Derivation Function (KDF):

• Input: a master key $K_{\text{master}}$
• Output: multiple derived keys for different purposes
• Example: $K_{\text{enc}} = E(K_{\text{master}}, 1)$, $K_{\text{mac}} = E(K_{\text{master}}, 2)$, $K_{\text{iv}} = E(K_{\text{master}}, 3)$

Why use a KDF?

• Never use the same key for multiple purposes
• A single shared secret (from key exchange) needs to produce multiple keys
• KDFs add domain separation — even if one derived key is compromised, others remain safe

Standard KDFs:

• HKDF (HMAC-based) — most common in TLS
• NIST SP 800-108 — uses block ciphers or HMAC
• PBKDF2 — for password-based key derivation (adds salt and iterations)

Go deeper:

• Key derivation function (Wikipedia) — HKDF, PBKDF2, and why one secret becomes many keys.
• RFC 5869 — HKDF — the extract-and-expand KDF used throughout TLS.