JEP 478 : Key Derivation Function API
Last updated
Last updated
"We define a new class, , to represent key derivation functions."
run
Have language version set in IDE - 24 (Preview) or add
A KDF turns a password or shared secret into a strong cryptographic key.
Used in:
Password-based encryption
Secure key exchange
Token generation (e.g., OAuth, JWT)
Before Java 24:
No standard KDF API in Java
Developers used low-level, inconsistent, or third-party code
Risk of insecure parameters (e.g., low iteration counts)
A Key Derivation Function (KDF) is used in cryptography to safely transform a shared secret or password into one or more cryptographic keys.
🔐 Encrypting with a password
Turns the password into a strong AES key
🔑 Secure key exchange
Derives keys from shared secrets (e.g., TLS)
🪪 Token signing/auth
Derives separate keys for encryption and MAC
🗂 Key rotation/management
Generates new keys from existing material
While KDFs aren't quantum-safe on their own, they help build hybrid cryptographic protocols that are:
🔐 Resilient to known quantum attacks (e.g., Shor's algorithm)
🧬 Useful in post-quantum key exchange
🧩 Critical in hybrid encryption — combining classical + quantum-safe keys
Quantum-safe key exchange algorithms (e.g., Kyber, Dilithium) produce raw shared secrets
A KDF (like HKDF) is used to stretch, compress, and standardize those secrets into usable keys
This ensures that even non-quantum-safe components (like AES) can be used securely in hybrid systems
In hybrid TLS (used by Google, Cloudflare, AWS):
Post-quantum and classical secrets are exchanged
Combined and passed into a KDF like HKDF
Output: symmetric keys for AES/GCM, HMAC, etc.
