I need some basic guideline on Password Based Key Derivation Function. PBKDF1 generates a key from password and salt using Hashing algorithm (like SHA1, SHA256, MD5).
What is the step behind this?
$\begingroup$
$\endgroup$
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
5
PBKDF1 as specified in PKCS#5 and RFC 2898 provides Key Derivation and Key Strengthening. The parameters of the function are a hash function (such as SHA-1), a password, a salt (sometimes called nonce, depending on context), an iteration count and the length of the derived key to be returned. The standard PBKDF1 will just calculate the hash of password concatenated with salt, and then hash the hash value that is returned by the previous step iteration count minus one times:
$$ K = H(H(...H(P||S)...))$$
If you only need key derivation but not key strengthening, use an iteration count of one. The purpose of the key strengthening is to increase the complexity of the key derivation, making certain attacks that exploit weak passwords more time consuming.
There are related key derivation functions that also provide Key Stretching, such as PBKDF2 and the .NET PasswordDeriveBytes function. Key Stretching is a feature that allows derived keys of any length to be returned, instead of being limited by the output length of the hash function.
answered Feb 11, 2012 at 18:45
-
$\begingroup$ Thanks a lot for your reply, I have two question from your answer, 1. PBKDF1 concatenated hash of password with salt or hash of salt?? 2. After concatenation the size will become double (320 bits (40 byte))?? $\endgroup$– SiddiquiFeb 11, 2012 at 18:59
-
2$\begingroup$ @Siddiqui: Have a look at the RFC link given by Henrick, it explains it quite clearly, I think. It is basically $H(H(H(...H(P||S)...)))$ (with throwing away superfluous bits after the derivation, if needed). The output size can get at most as large as the hash output size. You usually would use PBKDF-2 instead, as it inputs the password in each iteration again, thus avoiding collisions, and also allows for arbitrarily large outputs. (And it allows to use more functions, like HMAC.) $\endgroup$ Feb 11, 2012 at 19:49
-
$\begingroup$ You had to mention PasswordDeriveBytes didn't you? Note that it is unsafe to the extreme, never use it unless you request exactly 20 bytes - in which case it is just PBKDF1/SHA1 (which you should not use either, use PBKDF2). It is unspecified, returns different output on muliple getBytes() and may even repeat key bytes in the returned byte arrays. $\endgroup$– Maarten Bodewes ♦Feb 25, 2012 at 14:18
-
$\begingroup$ @owlstead: Yes, I had to mention PasswordDeriveBytes because I knew from side channels that Siddiqui was actually using that functions ;) $\endgroup$ Feb 25, 2012 at 14:55
-
1$\begingroup$ If you mention it again, would you please indicate a warning for future viewers? Nobody even seems to know how to implement it with all its bugs (well, except some people related to Microsoft, probably). $\endgroup$– Maarten Bodewes ♦Feb 25, 2012 at 14:58