3
$\begingroup$

When using PBKDF2, is there a practical upper limit to the iteration count above which we lose security?

Note: If you answer “No”, that's fine. But if you answer: “There can't be an upper limit“, Consider the case of $2^{256}$ iterations using SHA-256.

$\endgroup$
2
  • 1
    $\begingroup$ See this question $\endgroup$
    – mikeazo
    Jul 9, 2014 at 22:57
  • $\begingroup$ See also this and this. $\endgroup$
    – mikeazo
    Jul 9, 2014 at 23:02

1 Answer 1

3
$\begingroup$

When using PBKDF2, is there a practical upper limit to the iteration count above which we lose security?

No.

There is a limit above which you gain no security, but it isn't practical. It's on the order of $2^{128}$ iterations for PBKDF2-HMAC-SHA-2, or $2^{80}$ if you use SHA-1 as the HMAC hash. For an explanation, see the questions mikeazo linked in the comments.

However, due to the structure of PBKDF2 those collisions in the iterated hash likely don't undo the previous iterations, they only add to them (XOR). So the fact that you get collisions in the iterated function does put a limit on how much security you can gain from a high iteration count, since an attacker could stop iterating if they notice a collision. Nevertheless, they need to get that far and the ultimate hash is probably still different from all the other passwords, so that doesn't mean those extra iterations make it weaker.

Cycles, which you would notice about the same time, can technically "undo" previous iterations, but the unique iterations before the cycle begins are still strong, and the expected number of those is also close to $2^{128}$ for a 256-bit hash.

$\endgroup$
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.