Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I need some basic guideline on Password Based Key Derivation Function. PBKDF1 generates a key from password and salt using Hashing algorithm (like SHA1, SHA256, MD5).

What is the step behind this?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

PBKDF1 as specified in PKCS#5 and RFC 2898 provides Key Derivation and Key Strengthening. The parameters of the function are a hash function (such as SHA-1), a password, a salt (sometimes called nonce, depending on context), an iteration count and the length of the derived key to be returned. The standard PBKDF1 will just calculate the hash of password concatenated with salt, and then hash the hash value that is returned by the previous step iteration count minus one times:

$$ K = H(H(...H(P||S)...))$$

If you only need key derivation but not key strengthening, use an iteration count of one. The purpose of the key strengthening is to increase the complexity of the key derivation, making certain attacks that exploit weak passwords more time consuming.

There are related key derivation functions that also provide Key Stretching, such as PBKDF2 and the .NET PasswordDeriveBytes function. Key Stretching is a feature that allows derived keys of any length to be returned, instead of being limited by the output length of the hash function.

share|improve this answer
Thanks a lot for your reply, I have two question from your answer, 1. PBKDF1 concatenated hash of password with salt or hash of salt?? 2. After concatenation the size will become double (320 bits (40 byte))?? –  Siddiqui Feb 11 '12 at 18:59
@Siddiqui: Have a look at the RFC link given by Henrick, it explains it quite clearly, I think. It is basically $H(H(H(...H(P||S)...)))$ (with throwing away superfluous bits after the derivation, if needed). The output size can get at most as large as the hash output size. You usually would use PBKDF-2 instead, as it inputs the password in each iteration again, thus avoiding collisions, and also allows for arbitrarily large outputs. (And it allows to use more functions, like HMAC.) –  Paŭlo Ebermann Feb 11 '12 at 19:49
You had to mention PasswordDeriveBytes didn't you? Note that it is unsafe to the extreme, never use it unless you request exactly 20 bytes - in which case it is just PBKDF1/SHA1 (which you should not use either, use PBKDF2). It is unspecified, returns different output on muliple getBytes() and may even repeat key bytes in the returned byte arrays. –  owlstead Feb 25 '12 at 14:18
@owlstead: Yes, I had to mention PasswordDeriveBytes because I knew from side channels that Siddiqui was actually using that functions ;) –  Henrick Hellström Feb 25 '12 at 14:55
If you mention it again, would you please indicate a warning for future viewers? Nobody even seems to know how to implement it with all its bugs (well, except some people related to Microsoft, probably). –  owlstead Feb 25 '12 at 14:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.