# Is there any use for PBKDF with empty password?

As the name suggests, password based key derivation functions are used for deriving a cryptographic key from, well, a password.

Is there any use for PBKDFs with empty password? Does it give any advantage over simple hash or HMAC? More specifically, in the case of PBKDF2-HMAC it would mean applying HMAC with an empty key, simplifying it to a double hash.

For example, according to its documentation, OpenSSL allows calling PKCS5_PBKDF2_HMAC() with no password given, but RFC 6070 does not define test vectors for empty passwords (which IMHO would be an important edge case for test vectors).

• HMAC with an empty key dot not simplify to a double hash. It simplifies to $H(\text{opad}\|H(\text{ipad}\|s))$, where $s$ is the hashed string.
– fgrieu
Oct 11 '16 at 11:22