6
$\begingroup$

How much can I shorten a password hash before it begins to impact security?

Suppose that I use PBKDF2 (correctly salted) with HMAC-SHA256 as the PRF. From what I've seen, it's typical to use 256 bits of output, since that matches what comes out of the PRF.

My intuition suggests that there would be no security impact if this output were truncated to 128 bits. Is this correct? My reasoning here is that salting prevents multi-target attacks, and that collisions are unimportant in the context of password verification.

$\endgroup$
1
  • $\begingroup$ truncation of the hash may actually improve security in some ways, as it makes some of the hash state secret. how much that might help is unknown, but makes me prefer SHA512-256 over SHA256 $\endgroup$ Commented Sep 23, 2015 at 0:19

1 Answer 1

5
$\begingroup$

My intuition suggests that there would be no security impact if this output were truncated to 128 bits. Is this correct? My reasoning here is that salting prevents multi-target attacks, and that collisions are unimportant in the context of password verification.

Correct, there is no practical security impact. The preimage security of the hash function is what matters for password hashing, and 128 bits is long enough to prevent brute force preimage search. You could probably even go shorter than that, but database space is usually cheap which is why using the full 256 bits is common.

In principle, with a 129+ bit entropy password you would lose some security, as a brute force attack to find some password with the same hash would become faster. Such passwords are very uncommon, however, and the brute force would remain infeasible even if theoretically faster.

(If SHA-256 is found to be very weak after some new attack all bets are off. The attack could allow a faster preimage attack on truncated output or it could not. The opposite could even be the case.)

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.