3
$\begingroup$

I know that PBKDF2 is very useful for generating strong keys. I'm trying to know is there any additional contribution of the given password to produce even stronger keys.

Which key is more secure:

  1. A password: "123456" (length 6) is entered into PBKDF2 ---> Produced key
  2. A password: "XK6f+d" (length 6) is entered into PBKDF2 ---> Produced key
  3. A password: "123456789" (length 9) is entered into PBKDF2 ---> Produced key
  4. A password: "dYn5p78+/" (length 9) is entered into PBKDF2 ---> Produced key
  5. A password: "eh4P+S83ko/@bDBq" (length 16) is entered into PBKDF2 ----> Produced key

Does the strong key generation of PBKDF depends on the length of the password? Does longer passwords produce more stronger keys then shorter passwords? Does "XK6f+d" produces more stronger keys then "123456"?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

There are two inputs to PBKDF2, and key derivation functions in general: the password and a salt. Assuming the attacker knows the salt, all the password hash can do is slow down a brute force or dictionary search (i.e. 1000x the complexity of HMAC with PBKDF2 default iterations), as well as force the attacker to search for each user's password individually. In that case "123456" is an insecure password with any realistic password hash.

If you for some reason could assume that the salt is a strong secret random number of sufficient size, then the keys produced from all of those passwords would be equivalently unknowable. However, in that case you could just use a fast key derivation function. It's not the problem PBKDF2 is meant to solve.

TL;DR: PBKDF2 does not make poor passwords secure, just mediocre ones somewhat less mediocre.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Isn't the salt supposed to be non-secret? $\endgroup$
    – Giliweed
    Sep 13, 2014 at 10:47
  • 1
    $\begingroup$ @Giliweed, "supposed" is a bit strong. In practice you usually keep it secret if possible, but assume the attacker knows it anyway. $\endgroup$
    – otus
    Sep 13, 2014 at 10:50
  • $\begingroup$ @otus For password hashing you usually try to keep both salt and hash secure. But for key derivation you may not have access to any storage for the secret. (If you did, why would you not just put the key there?) $\endgroup$
    – kasperd
    Sep 13, 2014 at 14:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.