3
$\begingroup$

I would like to know if the following process would harm the security of a fictional system if the persisted data would be stolen: in this system a user has a single password. The password will be used in order to derive two different keys using the same key derivation function (PBKDF2/bcrypt/scrypt) with the same parameters but using different salts. One of the keys will be persisted on the system, the other will not. Both salts will be persisted, too.

Would the persisted key, besides allowing the theoretical brute forcing using the corresponding salt in order to retrieve the password, allow the attacker more information regarding the second key? Does it depend on the actual KDF?

$\endgroup$
  • $\begingroup$ Note that running the PBKDF twice forces you to halve the iteration count (assuming a fixed budget of computation time), making bruteforce attacks twice as fast. You could avoid this by using the PBKDF once, then deriving the two final keys with HKDF. $\endgroup$ – Tim McLean Apr 29 '15 at 22:20
2
$\begingroup$

With a KDF meeting its objectives, the only way the leak of the persisted key compromises the confidentiality of the other is correctly identified in the question: a password guess can be checked at the cost of one evaluation of the KDF based on the leaked key and its corresponding salt (and assuming the password's entropy is significantly less than the leaked key's width, it's unlikely there's a false positive); so when and if the password is found based on that, the second key is trivially found.

All KDFs have the objective that knowing the output with one salt, it's impossible to find (or otherwise obtain information about) the output for another salt with significantly less cost than testing the passwords (or more generally: than testing values fed to the key input of the KDF, for those KDFs that are not purposely slow in order to stretch a password's limited entropy). PBKDF2, bcrypt and scrypt convincingly meet that objective.

So the answers to the questions in the last paragraph are no, and no for a good KDF. For the question in the title, I'd answer yes, for a good KDF, and within the fact that the common password can be brute-forced with enough effort.

$\endgroup$
  • $\begingroup$ In this situation I would tend to differentiate the keys by adding "-KEY1" and "-KEY2" to the initial master password before input to the KDF, YMMV. $\endgroup$ – rossum Apr 30 '15 at 22:29
  • $\begingroup$ @rossum: your appendix is to belt what salt+KDF are to suspenders. $\endgroup$ – fgrieu May 1 '15 at 19:18
  • $\begingroup$ @fgrieu Agreed. This is crypto, so belt and braces (I am English) are often the default. $\endgroup$ – rossum May 1 '15 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.