KeyDerivationAlgorithmProvider KeyDerivationAlgorithmProvider KeyDerivationAlgorithmProvider KeyDerivationAlgorithmProvider KeyDerivationAlgorithmProvider Class


Represents a key derivation algorithm provider.

public : sealed class KeyDerivationAlgorithmProvider : IKeyDerivationAlgorithmProvider
struct winrt::Windows::Security::Cryptography::Core::KeyDerivationAlgorithmProvider : IKeyDerivationAlgorithmProvider
public sealed class KeyDerivationAlgorithmProvider : IKeyDerivationAlgorithmProvider
Public NotInheritable Class KeyDerivationAlgorithmProvider Implements IKeyDerivationAlgorithmProvider
// This class does not provide a public constructor.
Windows 10 requirements
Device family
Windows 10 (introduced v10.0.10240.0)
API contract
Windows.Foundation.UniversalApiContract (introduced v1)


using Windows.Security.Cryptography;
using Windows.Security.Cryptography.Core;
using Windows.Storage.Streams;

namespace SampleKeyDerivationAlgorithm
    sealed partial class SampleKeyDerivationProviderApp : Application
        public SampleKeyDerivationProviderApp()
            // Initialize the Application.

            // Derive key material from a password-based key derivation function.
            String strKdfAlgName = KeyDerivationAlgorithmNames.Pbkdf2Sha256;
            UInt32 targetKeySize = 32;
            UInt32 iterationCount = 10000;
            IBuffer buffKeyMatl = this.SampleDeriveKeyMaterialPbkdf(

            // Create a key.
            CryptographicKey key = this.SampleCreateKDFKey(

        public IBuffer SampleDeriveKeyMaterialPbkdf(
            String strAlgName,
            UInt32 targetKeySize,
            UInt32 iterationCount)

            // Open the specified algorithm.
            KeyDerivationAlgorithmProvider objKdfProv = KeyDerivationAlgorithmProvider.OpenAlgorithm(strAlgName);

            // Demonstrate how to retrieve the algorithm name.
            String strAlgUsed = objKdfProv.AlgorithmName;

            // Create a buffer that contains the secret used during derivation.
            String strSecret = "MyPassword";
            IBuffer buffSecret = CryptographicBuffer.ConvertStringToBinary(strSecret, BinaryStringEncoding.Utf8);

            // Create a random salt value.
            IBuffer buffSalt = CryptographicBuffer.GenerateRandom(32);

            // Create the derivation parameters.
            KeyDerivationParameters pbkdf2Params = KeyDerivationParameters.BuildForPbkdf2(buffSalt, iterationCount);

            // Create a key from the secret value.
            CryptographicKey keyOriginal = objKdfProv.CreateKey(buffSecret);

            // Derive a key based on the original key and the derivation parameters.
            IBuffer keyMaterial = CryptographicEngine.DeriveKeyMaterial(

            // Demonstrate checking the iteration count.
            UInt32 iterationCountOut = pbkdf2Params.IterationCount;

            // Demonstrate returning the derivation parameters to a buffer.
            IBuffer buffParams = pbkdf2Params.KdfGenericBinary;

            // return the KDF key material.
            return keyMaterial;

        public CryptographicKey SampleCreateKDFKey(
            String strAlgName,
            IBuffer buffKeyMaterial)
            // Create a KeyDerivationAlgorithmProvider object and open the specified algorithm.
            KeyDerivationAlgorithmProvider objKdfAlgProv = KeyDerivationAlgorithmProvider.OpenAlgorithm(strAlgName);

            // Create a key by using the KDF parameters.
            CryptographicKey key = objKdfAlgProv.CreateKey(buffKeyMaterial);

            return key;


When two or more parties share a secret symmetric key, it is often necessary to derive additional keys for use in cryptographic operations. It is also often necessary for a trusted third party to derive distinct cryptographic keys from a single master key. Key derivation functions are used to derive these additional keys.

You can use the static DeriveKeyMaterial method in the CryptographicEngine class and the following methods in the KeyDerivationParameters class to derive a key.

BuildForPbkdf2 Creates a KeyDerivationParameters object for use in the password-based key derivation function 2 (PBKDF2).
BuildForSP800108 Creates a KeyDerivationParameters object for use in a counter mode, hash-based message authentication code (HMAC) key derivation function.
BuildForSP80056a Creates a KeyDerivationParameters object for use in the SP800-56A key derivation function.

You create a KeyDerivationAlgorithmProvider object by calling the static OpenAlgorithm method.


AlgorithmName AlgorithmName AlgorithmName AlgorithmName AlgorithmName

Gets the name of the open key derivation function (KDF) algorithm.


CreateKey(IBuffer) CreateKey(IBuffer) CreateKey(IBuffer) CreateKey(IBuffer) CreateKey(IBuffer)

Creates a KDF key.

OpenAlgorithm(String) OpenAlgorithm(String) OpenAlgorithm(String) OpenAlgorithm(String) OpenAlgorithm(String)

Creates an instance of the KeyDerivationAlgorithmProvider class and opens the specified algorithm for use.

See Also