As the name suggests, password based key derivation functions are used for deriving a cryptographic key from, well, a password.

Is there any use for PBKDFs with empty password? Does it give any advantage over simple hash or HMAC? More specifically, in the case of PBKDF2-HMAC it would mean applying HMAC with an empty key, simplifying it to a double hash.

For example, according to its documentation, OpenSSL allows calling PKCS5_PBKDF2_HMAC() with no password given, but RFC 6070 does not define test vectors for empty passwords (which IMHO would be an important edge case for test vectors).

  • 1
    $\begingroup$ HMAC with an empty key dot not simplify to a double hash. It simplifies to $H(\text{opad}\|H(\text{ipad}\|s))$, where $s$ is the hashed string. $\endgroup$
    – fgrieu
    Commented Oct 11, 2016 at 11:22

1 Answer 1


While it might be possible to use an empty password, the reason for that is most likely that any exclusion would also be known to the attacker.

However, I wouldn't call it an important test case. A PBKDF does not protect from choosing bad passwords, it only makes the dictionary attack take a lot more computational effort. If one of the first guesses is correct already, no password-based KDF will protect against that. And if the empty password is allowed, it surely is quite high in that list.

Alternatively, they could have just overlooked that case. Or they decided against it. Only the authors might be able to answer your question with certainty.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.