🧱PBKDF2

NEW

A password-based key derivation function that applies a pseudorandom function to a password and salt iteratively to produce derived keys.

DESCRIPTION

PBKDF2, standardized in PKCS #5 (RFC 8018), strengthens passwords by applying a pseudorandom function (commonly HMAC) to a password and unique salt repeatedly. The iteration count raises computational cost for attackers, making brute force more expensive. While widely deployed and FIPS-validated, PBKDF2 is compute-hard, not memory-hard. Modern guidance often recommends memory-hard alternatives like Argon2 or scrypt for new deployments.

ALTERNATIVE DEFINITIONS

IETF RFC 8018 (PKCS #5 v2.1)

PBKDF2 applies a pseudorandom function to the input password along with a salt value and repeats the process many times to produce a derived key.

Core algorithmic description emphasizing salt and iterations.

Source

NIST SP 800-63B

Verifiers storing memorized secrets SHALL use a suitable one-way key derivation function.

Mandates use of KDFs like PBKDF2 for secure storage.

Source

RELATED TERMS

Key Derivation Function Salt Password Hashing HMAC PKCS #5 Iteration Count Credential Storage

COMPETING TERMS

scrypt Argon2 bcrypt

KNOWLEDGE AREAS

Data Security Mathematics

TARGET AUDIENCE

Security Architect Cybersecurity Engineer Software Developer DevOps Engineer

EXTERNAL SOURCES

• Wikipedia - PBKDF2
• IETF - Official PBKDF2 specification.
• NIST CAVP - Validation program for cryptographic algorithms.
• OWASP - Guidance on password storage and PBKDF2.

TOP QUESTIONS

When should I use PBKDF2?

Use PBKDF2 for compatibility or compliance needs, ensuring high iteration counts and unique salts; prefer memory-hard KDFs for new systems when feasible.

Category: UseCases

Which PRF is typically used with PBKDF2?

HMAC with SHA-256 or SHA-512 is commonly used and widely supported.

Category: Tooling

How many iterations are recommended for PBKDF2?

Choose a work factor that meets a target time (e.g., ~100 ms) on your hardware; revisit regularly as hardware improves.

Category: BestPractices

Does PBKDF2 protect against GPU/ASIC attacks?

It increases cost but is compute-bound; memory-hard KDFs like Argon2 or scrypt offer stronger resistance to specialized hardware.

Category: Risks

How do I migrate from PBKDF2 to Argon2?

Use progressive rehashing: verify with PBKDF2, then rehash with Argon2 on login and update stored hashes gradually.

Category: Management

Is PBKDF2 suitable for deriving encryption keys?

Yes, with proper parameters and salts; ensure keys are unique per context and consider HKDF for key expansion.

Category: Concepts

What mistakes occur with PBKDF2?

Using low iteration counts, missing per-record salts, or truncating derived keys unsafely.

Category: Mistakes

How to store PBKDF2 parameters?

Store algorithm, iterations, salt, and derived key in a structured format to support upgrades and verification.

Category: BestPractices

Where to learn PBKDF2 details?

Review RFC 8018 and OWASP Password Storage Cheat Sheet for secure parameter choices.

Category: GettingStarted