dv = salt + PBKDF2(salt + password, salt)
Versus the "plain" usage of
dv = PBKDF2(password, salt)
When using the
PBKDF2 function or Armin Ronacher's version (both linked above), do the extra salt parameters add any benefit if no two passwords will have the same salt (but the salt will be stored with the password)?
Presumably the risk is having an oracle whereby identical passwords would be revealed as-such, encoded. Is this the case or is there another concern one ought to be mindful of?
If this is the only concern I would expect, in the absence of a fault in the algorithms that permits short-circuiting, a plainly used salt obliges one to recheck every password the entire number of iterations. Is this the case?
(Incidentally, this is copied from my post on SO, which was inexplicably closed).
It is worth linking:
- How to store a salt
- How to securely hash passwords
- and Password Hashing add salt + pepper or is salt enough?
The last link in particular states, in the question:
As far as I know, the recommended/approved method for storing password verifiers is to store:
$verifier = $salt + hash( $salt + $password )
In a sense this question becomes "is it necessary to inject the salt into a KDF in the same way as is recommended for a hash"? (presuming of course that the theory supports the injection of a salt for a hash - though I believe it does)