2
$\begingroup$

Is it safe to use a KDF implementation in order to store passwords?

More broadly, is this standard? Do IT-companies really use KDF? Or do they usually rely on other algorithms?

If you have any practical example for the second question, I would appreciate it.

Improve this question
$\endgroup$
1
  • 2
    $\begingroup$ I'm voting to close this question as off-topic because it has nothing to do with cryptography. This is quite similar our off-topic closing reason for software recommendations or programming questions. Policies to use or not use cryptographic algorithms isn't about crypto itself. Security-SE might be a good fit for this question. $\endgroup$
    – tylo
    Sep 8, 2017 at 16:16

1 Answer 1

Reset to default
3
$\begingroup$

Yes and no, depending on what you mean by "storing passwords". If you mean "storing my own passwords in a password store", then "no", since this is clearly not the goal of a KDF. But if you mean "storing authentication data in a database to authenticate our users", then yes, since passwords stored in that way are really hard to recover.

And "yes", companies do use KDF and will keep using it more and more. Notably because NIST has standardized their usage in their latest publication on password storage: NIST.SP.800-63b which says that:

Verifiers SHALL store memorized secrets [i.e. passwords] in a form that is resistant to offline attacks. Memorized secrets SHALL be salted and hashed using a suitable one-way key derivation function.
Key derivation functions take a password, a salt, and a cost factor as inputs then generate a password hash. Their purpose is to make each password guessing trial by an attacker who has obtained a password hash file expensive and therefore the cost of a guessing attack high or prohibitive.

and also because nowadays, data leakages are extremely damageable to any company's PR.

There are two different kind of KDFs:

  1. those for when you have a poor entropy and are afraid of Dictionary Attacks (typically if you store humanly memorable passwords), e.g. Argon2, Balloon, PBKDF, etc.
  2. those that you use when you have a good entropy, which would for example be the case if you rely on the DH protocol to establish a common key. Like e.g. HKDF which is thought for such need-case.

The type I'm talking about here is of the first sort, when you store passwords in a database in order to authenticate users. I personally have a preference for Argon2. Since other like PBKDF2, can be implemented on ASIC devices, which makes brute-force attacks using such devices much easier, or have less parameters one can tweak... Plus it was chosen as the winner of the password-hashing competition.

Now regarding whether KDFs are actually used, you can simply take a look at most password authentications out there and I believe you'll see that the most important ones do... For instance, LastPass advertises using PBKDF2 to protect your password-store main password and you can tweak yourself the number of iteration done. The Django's framework documentation also mention PBKDF2 as being its default algorithm.
Finally, Wikipedia has a nice list of things using PBKDF2. (Which is still the most used KDF, despite the existence of theoretically better ones.)

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.