1
$\begingroup$

PBKDF2 can be used to derive a key from a passphrase, having in input the passphrase, the chosen number of iterations to slow down a brute force attack, a random salt and the chosen keylength. In its implementation it needs a PRNG which can be, for example, HMAC-SHA-something; but HMAC needs itself a key together with a "message" (which I think is the passphrase in the first iteration, and then its resulting hash in the subsequent ones): so what is this key?

$\endgroup$
2
$\begingroup$

The password, encoded as octet string (usually using ASCII or UTF-8 as encoding), is used as key. The salt is used as data to HMAC.

The scheme specifies the following internal calculation:

U_1 = PRF (P, S || INT (i)) ,
U_2 = PRF (P, U_1) ,
...
U_c = PRF (P, U_{c-1}) .

where $P$ is the encoded password, $c$ is the iteration count, $S$ the salt and $\operatorname{INT}(i)$ an indicator of the output block (if more than a single block of output is required from the PRF). The PRF is not found in any other part of the scheme (PBKDF2 is not a complex protocol, you could argue too simple).

The PRF can be any pseudo random function, but it is usually set to HMAC-SHA-1 used as default:

The default pseudorandom function is HMAC-SHA-1:

in other words, PRF(P, X) can be read as HMAC-SHA-1(P, X).

$\endgroup$
2
$\begingroup$

The key is the password.

For the first iteration, the salt concatenated with the desired output length in bytes is the input.
U1 = PRF(Password, Salt || INT_32_BE(i))

For subsequent iterations, the HMAC result is the salt.
U2 = PRF(Password, U1)
...
Uc = PRF(Password, Uc-1)

$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.