# Calculate entropy of key derived from PBKF2 function

I am using PBKF2 to derive a encryption key from a password. suppose entropy of my password is y and my PBKF2 function has x number of iterations. So how to calculate the entropy of finale key derived from the PBKF2 function.

According to the paper Stronger Key Derivation Via Sequential Memory-Hard Functions

If

$$2^k = x$$

the entropy of the derived key (DK) key will be

$$2^{k}+y$$

• (up to a maximum of the output length specified to the PBKDF2 algorithm) – Thomas Dec 20 '13 at 14:36
• $2^{k+y}$ is not the "entropy" of the derived key; the entropy of DK is at most the sum of the entropies of the inputs to the (deterministic) KDF (i.e. $y$ bits). Besides, entropy is measured in bits. At any rate, $2^{k+y}$ is, to quote the paper, "the cost of performing a brute-force attack against passwords with [$y$] bits of entropy". This is probably what everyone is thinking of anyway, but that's not entropy. – Reid Dec 20 '13 at 21:27
• @Reid So if the salt value has entropy of n, then finale entropy of the output key will be y+n. Am I correct? Also number of rounds performed also will have to be considered. – deltaaruna Dec 21 '13 at 2:06
• @deltaaruna The salt is not (intended to be) secret, so it has zero entropy. The password has entropy $e$, and you use $2^k$ rounds - so the total amount of "work" in the computational sense to brute force the password is on the order of $2^k 2^e = 2^{k + e}$, so the "entropy" is $k + e$ (again, in the computational sense - the information-theoretical entropy of the key is at most the entropy of its inputs, but since it takes more work to verify your guess you can think of it as "extra passwords to check", e.g. 2 iterations = twice as many passwords to check computationally = +1 bit entropy). – Thomas Dec 21 '13 at 2:21