KDFs are mostly invisible to administrators because the platform handles key derivation internally. The steps below cover the cases where KDF concepts matter for custom code or Shield architecture decisions.
- Identify scenarios requiring KDF awareness
Most administrators never need to think about KDFs. Awareness matters for Shield architects designing rotation strategy and Apex developers building custom encryption.
- For Shield rotation, plan the cadence
The KDF chain enables non-disruptive rotation. Plan quarterly or annual rotation; the KDF is what makes this feasible at scale.
- After rotation, run Mass Encryption
Mass Encryption re-derives data keys for older records under the new tenant secret. Without it, old keys remain in use indefinitely.
- For custom Apex, use Crypto.generateMac()
Need HMAC-based derivation? Use the built-in Crypto.generateMac(). Need stronger password hashing? Use an external library through a Named Credential proxy, not hand-rolled Apex.
- Audit custom encryption code
Any Apex code handling passwords or deriving keys deserves a security review. Hand-rolled KDFs are a common vulnerability source.
- Document KDF choices for compliance
Compliance auditors may ask which KDF algorithms protect your data. Shield documentation answers this; document custom code separately.
- Benchmark performance impact
For Cache-Only Key Service or heavy custom encryption, the KDF cost is observable. Benchmark before production to set expectations.
Platform-managed. Administrators do not configure directly; rotation is the visible operation.
Platform-managed for Salesforce passwords. Users never see the derivation.
HMAC-based derivation for custom Apex needs.
For stronger password hashing in custom apps, call an external service.
Handles authentication including password storage. The standard alternative to custom KDF in Apex.
- Hand-rolling a KDF in Apex is a serious security risk. Standard algorithms exist for a reason; custom implementations usually have subtle bugs.
- KDF slowness compounds with HSM round-trip for Cache-Only Key Service. The combined cost can make encrypted-field queries noticeably slower than plaintext queries.
- Salt and IV are different concepts often confused. Salt prevents identical KDF outputs; IV prevents identical ciphertexts. Both serve uniqueness but in different contexts.
- Mass Encryption after rotation is the step that makes rotation meaningful. Skipping it means old keys remain in use indefinitely.
- Compliance audits sometimes ask about KDF specifics. Shield documents the algorithms; custom code needs separate documentation.