Why a derivation function exists at all
Human credentials come from a far smaller and more predictable space than random encryption keys. A key derivation function bridges that gap by combining what you type with a unique salt and a deliberate computational cost.
The cost is the point. It makes each guess expensive, so an attacker testing a list of likely credentials pays that price on every attempt rather than testing millions per second.
What each function actually does
PBKDF2 is widely standardised, well understood, and available almost everywhere. It raises cost primarily through repeated computation — a high iteration count applied to a hash function.
Argon2id adds tunable memory cost alongside computation. Requiring a substantial amount of memory per guess reduces the advantage of specialised parallel hardware, which is where large-scale guessing gets its economics.
Why iteration counts are not comparable across algorithms
It is tempting to compare a PBKDF2 iteration count against an Argon2id time parameter, but they measure different things and the numbers are not interchangeable.
What matters is the total cost imposed per guess on realistic attacker hardware, which depends on memory, parallelism, and time parameters together. A published parameter set can be evaluated; a single number quoted without context cannot.
The parts that matter as much as the algorithm
- A unique random salt per credential, so precomputation gains nothing.
- Published parameters, and a stated migration path when they are raised.
- Versioning, so existing users can be upgraded rather than stranded.
- Where the derived key is stored between sessions, which is a separate control entirely.
- The strength of the credential itself, which no derivation function can manufacture.
Reading the claim
- Comparing iteration numbers across different algorithms as though they were equivalent.
- Calling any short human PIN strong because a derivation function is involved.
- Assuming a modern algorithm compensates for a weak or reused credential.
The practical summary
Argon2id with sensible memory and time parameters is the better default for new designs, and a correctly configured PBKDF2 with a high iteration count remains defensible.
Either choice is undermined by a four-digit credential. The derivation function raises the cost per guess; it does not reduce how few guesses there are.
A fictional example
Maya starts with a non-sensitive test: “Look for published parameters and migration strategy.” Next, Maya follows the second check: “Confirm unique random salts.” This fictional scenario demonstrates the decision process; it is not a report of product testing.
Common mistakes
- Comparing iteration numbers across different algorithms directly
- Calling any human PIN strong because a KDF exists
What this workflow does not change
- Comparing iteration numbers across different algorithms directly
- Calling any human PIN strong because a KDF exists
Questions people ask
What does NullVault use?
The Android design specifies memory-hard Argon2id key derivation.