Key Derivation Functions vs. Password Hashing Schemes
Key-stretching key derivation functions must produce results that have certain randomness properties, and be very difficult to reverse. Password hashes only need to satisfy the property &quot;difficult to reverse&quot;, without randomness requirements. This is why all key-stretching key derivation functions work as password hashes but not the other way around.
Note that there are also key derivation functions that are non-stretching. Stretching functions are inherently slow, and this is necessary for password hashing. Fast key derivation functions such as HKDF are not suitable when the input has a low entropy, for example a password, regardless of whether the goal is to derive key material or a password hash.