Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

It is my understanding that a KDF adds entropy, whereas a hash loses information.

I've read that KDF should be used to store passwords. I don't understand why we don't use a KDF and then a hash, so that – if the database of password is leaked – it would also be impossible to figure out the plain passwords.

So storing passwords in a database would be like this:

  1. Use KDF to increase entropy (especially good if users are using short passwords),
  2. Use a hash to lose information,
  3. Store the hash.

Shouldn't this be the advised way to store passwords?

share|improve this question
I think you have a misunderstanding of how KDFs are built, and how they work. KDFs do not increase entropy. Most KDFs are built from hash functions. – Richie Frame May 26 '14 at 6:19

It is my understanding that a KDF adds entropy, whereas a hash loses information.

Password Based KDFs can be seen as hash functions (or families of hash functions, depending on your definition), just ones with a lot of complexity. It is sometimes said that they "add entropy" but that usually means either

  1. they combine entropy from a salt into the password hash (which you can do with any hash function), or
  2. they make the password more computationally difficult to crack as if it had more entropy (also called computational entropy).

PBKDFs and hashes are irreversible; meaning that it is impossible to find a password without performing a brute force or dictionary attack. PBKDF's make it computationally harder to perform a brute force search and the salt makes it impossible to find matching passwords within a database.

Both PBKDFs and hashes "lose information" in the sense that their image (output) is smaller than their input domain. That does not make them stronger, however, since if two passwords give the same output hash, either can be used as authentication.

So using a hash after a KDF is at best redundant and can lead to less security through e.g. increased collisions.

share|improve this answer
Why do people advise using KDF instead of Hash to store passwords then? – David 天宇 Wong May 26 '14 at 16:23
@David天宇Wong, because of the computational complexity. You don't really care whether the password hash has actual entropy, only whether an attacker can crack it or not. – otus May 26 '14 at 16:28
Without enough entropy you are always in trouble; it is not feasible to use a password based KDF in such a way that you can add enough complexity to fend of attacks. In that sense a PBKDF only adds a limited amount of protection, choosing a good password is and always will be a must if protection against offline attacks is a requirement. – Maarten Bodewes May 28 '14 at 11:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.