Question: I've seen many descriptions of KDF1 and KDF2 by now, but most documents simply point to specifications that are behind a pay wall. These standards are not specific to the KDF's; they just use these KDF's as sub-part of an algorithm description (key agreement). Does somebody have a formal description of both KDF's that adheres to the standards?

The description should include additional information to derive a key such as `OtherInfo` field or label, or indicate their absence. Needless to say the other input parameters and the use of the internal counter would be needed for the full algorithm as well.

The standards can be found in IEEE Std 1363-2000, ANSI X9.42 (KDF1) and ISO 18033-2 (KDF2). That last standard defines OID's for them, KDF1 is [`1.0.18033.2.5.1`](http://www.oid-info.com/get/1.0.18033.2.5.1) and KDF2 is [`1.0.18033.2.5.2`](http://www.oid-info.com/get/1.0.18033.2.5.2) (unprotected links to oid-info.com).

Answer: 
[FCD 18033-2
Encryption algorithms — Part 2:
Asymmetric ciphers](https://www.shoup.net/iso/std6.pdf) - the final committee draft (FCD) of ISO/IEC 18033 - by Victor Shoup is publicly available from his website and specifies (in section 6.2) that KDF1 is

> 
> For an octet string $x$ and a non-negative integer $l$, $\operatorname{KDF1(x,l)}$ is defined to be the first $l$ octets of
> 
> 
> $$\operatorname{Hash.eval}(x || \operatorname{I2OSP}(0, 4)) || ··· || \operatorname{Hash.eval}(x || \operatorname{I2OSP}(k − 1, 4)),$$
> 
> 
> where $$k = \lceil l/\text{Hash.len} \rceil $$
> 
> 
> 

The binary counter representation should translate to 4 bytes in big endian.

KDF2 is identical but starts counting from 1 instead of 0.
So... Googling around KDF1 is [supposedly](https://forum.powerbasic.com/forum/user-to-user-discussions/source-code/60253-key-derivation-functions-kdf1-kdf2-kdf3-iso-18033-2) the same as MGF1 as defined in PKCS#1 2.1, which can be found in [Appendix B](https://www.rfc-editor.org/rfc/rfc3447#appendix-B.2) of RFC 3447. KDF2 is nearly the same as KDF1 except the counter runs from 1 to n instead of from 0 to n - 1.