Skip to main content
Cryptography

Return to Answer

fleshed out, formatted, distinction between KDF and PBKDF
Source Link
Maarten Bodewes ♦
Maarten Bodewes ♦
  • 94.5k
  • 13
  • 165
  • 319

It is my understanding that a KDF adds entropy, whereas a hash loses information.

Password Based KDFs arecan be seen as hash functions (or families of hash functions, depending on your definition), just ones with a lot of complexity. It is sometimes said that they "add entropy" but that usually means either 1) they combine entropy from

  1. they combine entropy from a salt into the password hash (which you can do with any hash function), or
  2. they make the password more computationally difficult to crack as if it had more entropy (also called computational entropy).

PBKDFs and hashes are irreversible; meaning that it is impossible to find a salt into the password hash (which you can do with any hash function)without performing a brute force or 2) theydictionary attack. PBKDF's make the password moreit computationally difficultharder to crack as ifperform a brute force search and the salt makes it had more entropy (also called computational entropy)impossible to find matching passwords within a database.

Likewise, both KDFsBoth PBKDFs and hashes "lose information" in the sense that collisions usually mean their image (output) is smaller than their input domain. That does not make them stronger, however, since if two passwords give the same output hash, either can be used as authentication.

So using a hash after a KDF is at best redundant and can lead to less security through e.g. increased collisions.

It is my understanding that a KDF adds entropy, whereas a hash loses information.

KDFs are hash functions (or families of hash functions, depending on your definition), just ones with a lot of complexity. It is sometimes said that they "add entropy" but that usually means either 1) they combine entropy from a salt into the password hash (which you can do with any hash function) or 2) they make the password more computationally difficult to crack as if it had more entropy (also called computational entropy).

Likewise, both KDFs and hashes "lose information" in the sense that collisions usually mean their image is smaller than their domain. That does not make them stronger, however, since if two passwords give the same output hash, either can be used as authentication.

So using a hash after a KDF is at best redundant and can lead to less security through e.g. increased collisions.

It is my understanding that a KDF adds entropy, whereas a hash loses information.

Password Based KDFs can be seen as hash functions (or families of hash functions, depending on your definition), just ones with a lot of complexity. It is sometimes said that they "add entropy" but that usually means either

  1. they combine entropy from a salt into the password hash (which you can do with any hash function), or
  2. they make the password more computationally difficult to crack as if it had more entropy (also called computational entropy).

PBKDFs and hashes are irreversible; meaning that it is impossible to find a password without performing a brute force or dictionary attack. PBKDF's make it computationally harder to perform a brute force search and the salt makes it impossible to find matching passwords within a database.

Both PBKDFs and hashes "lose information" in the sense that their image (output) is smaller than their input domain. That does not make them stronger, however, since if two passwords give the same output hash, either can be used as authentication.

So using a hash after a KDF is at best redundant and can lead to less security through e.g. increased collisions.

Source Link
otus
otus
  • 32.4k
  • 5
  • 73
  • 167

It is my understanding that a KDF adds entropy, whereas a hash loses information.

KDFs are hash functions (or families of hash functions, depending on your definition), just ones with a lot of complexity. It is sometimes said that they "add entropy" but that usually means either 1) they combine entropy from a salt into the password hash (which you can do with any hash function) or 2) they make the password more computationally difficult to crack as if it had more entropy (also called computational entropy).

Likewise, both KDFs and hashes "lose information" in the sense that collisions usually mean their image is smaller than their domain. That does not make them stronger, however, since if two passwords give the same output hash, either can be used as authentication.

So using a hash after a KDF is at best redundant and can lead to less security through e.g. increased collisions.