Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using PBKF2 to derive a encryption key from a password. suppose entropy of my password is y and my PBKF2 function has x number of iterations. So how to calculate the entropy of finale key derived from the PBKF2 function.

share|improve this question

According to the paper Stronger Key Derivation Via Sequential Memory-Hard Functions


$$2^k = x$$

the entropy of the derived key (DK) key will be


share|improve this answer
(up to a maximum of the output length specified to the PBKDF2 algorithm) – Thomas Dec 20 '13 at 14:36
$2^{k+y}$ is not the "entropy" of the derived key; the entropy of DK is at most the sum of the entropies of the inputs to the (deterministic) KDF (i.e. $y$ bits). Besides, entropy is measured in bits. At any rate, $2^{k+y}$ is, to quote the paper, "the cost of performing a brute-force attack against passwords with [$y$] bits of entropy". This is probably what everyone is thinking of anyway, but that's not entropy. – Reid Dec 20 '13 at 21:27
@Reid So if the salt value has entropy of n, then finale entropy of the output key will be y+n. Am I correct? Also number of rounds performed also will have to be considered. – deltaaruna Dec 21 '13 at 2:06
@deltaaruna The salt is not (intended to be) secret, so it has zero entropy. The password has entropy $e$, and you use $2^k$ rounds - so the total amount of "work" in the computational sense to brute force the password is on the order of $2^k 2^e = 2^{k + e}$, so the "entropy" is $k + e$ (again, in the computational sense - the information-theoretical entropy of the key is at most the entropy of its inputs, but since it takes more work to verify your guess you can think of it as "extra passwords to check", e.g. 2 iterations = twice as many passwords to check computationally = +1 bit entropy). – Thomas Dec 21 '13 at 2:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.