5
$\begingroup$

I would like to know if the following process would harm the security of a fictional system if the persisted data would be stolen: in this system a user has a single password. The password will be used in order to derive two different keys using the same key derivation function (PBKDF2/bcrypt/scrypt) with the same parameters but using different salts. One of the keys will be persisted on the system, the other will not. Both salts will be persisted, too.

Would the persisted key, besides allowing the theoretical brute forcing using the corresponding salt in order to retrieve the password, allow the attacker more information regarding the second key? Does it depend on the actual KDF?

Improve this question
$\endgroup$
1
  • $\begingroup$ Note that running the PBKDF twice forces you to halve the iteration count (assuming a fixed budget of computation time), making bruteforce attacks twice as fast. You could avoid this by using the PBKDF once, then deriving the two final keys with HKDF. $\endgroup$
    – Tim McLean
    Apr 29, 2015 at 22:20

1 Answer 1

Reset to default
4
$\begingroup$

With a KDF meeting its objectives, the only way the leak of the persisted key compromises the confidentiality of the other is correctly identified in the question: a password guess can be checked at the cost of one evaluation of the KDF based on the leaked key and its corresponding salt (and assuming the password's entropy is significantly less than the leaked key's width, it's unlikely there's a false positive); so when and if the password is found based on that, the second key is trivially found.

All KDFs have the objective that knowing the output with one salt, it's impossible to find (or otherwise obtain information about) the output for another salt with significantly less cost than testing the passwords (or more generally: than testing values fed to the key input of the KDF, for those KDFs that are not purposely slow in order to stretch a password's limited entropy). PBKDF2, bcrypt and scrypt convincingly meet that objective.

So the answers to the questions in the last paragraph are no, and no for a good KDF. For the question in the title, I'd answer yes, for a good KDF, and within the fact that the common password can be brute-forced with enough effort.

Improve this answer
$\endgroup$
3
  • $\begingroup$ In this situation I would tend to differentiate the keys by adding "-KEY1" and "-KEY2" to the initial master password before input to the KDF, YMMV. $\endgroup$
    – rossum
    Apr 30, 2015 at 22:29
  • $\begingroup$ @rossum: your appendix is to belt what salt+KDF are to suspenders. $\endgroup$
    – fgrieu ♦
    May 1, 2015 at 19:18
  • $\begingroup$ @fgrieu Agreed. This is crypto, so belt and braces (I am English) are often the default. $\endgroup$
    – rossum
    May 1, 2015 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.