Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

When using PBKDF2, is there a practical upper limit to the iteration count above which we lose security?

Note: If you answer “No”, that's fine. But if you answer: “There can't be an upper limit“, Consider the case of $2^{256}$ iterations using SHA-256.

share|improve this question
1  
See this question –  mikeazo Jul 9 at 22:57
    
See also this and this. –  mikeazo Jul 9 at 23:02

1 Answer 1

up vote 3 down vote accepted

When using PBKDF2, is there a practical upper limit to the iteration count above which we lose security?

No.

There is a limit above which you gain no security, but it isn't practical. It's on the order of $2^{128}$ iterations for PBKDF2-HMAC-SHA-2, or $2^{80}$ if you use SHA-1 as the HMAC hash. For an explanation, see the questions mikeazo linked in the comments.

However, due to the structure of PBKDF2 those collisions in the iterated hash likely don't undo the previous iterations, they only add to them (XOR). So the fact that you get collisions in the iterated function does put a limit on how much security you can gain from a high iteration count, since an attacker could stop iterating if they notice a collision. Nevertheless, they need to get that far and the ultimate hash is probably still different from all the other passwords, so that doesn't mean those extra iterations make it weaker.

Cycles, which you would notice about the same time, can technically "undo" previous iterations, but the unique iterations before the cycle begins are still strong, and the expected number of those is also close to $2^{128}$ for a 256-bit hash.

share|improve this answer
    
+1. Thanks.​​​​​​​​​​​​​​​​​​​​​​​​​ –  ispiro Jul 29 at 19:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.