1
$\begingroup$

Imagine two PBKDF2-SHA-512 hashes of the same password are generated. Each has individual salt. If an attacker had one hash and the salt of both hashes, would he be able to compute the missing hash or would he gain a significant advantage guessing it?

My situation: A user inputs a password that should be used for AES encryption. The password is hashed once to get a AES Key. Then a second hash of the password the user entered is generated with a different salt than the first one and is sent to the server together with the salts of both hashes. Can a attacker who hijacked the server, calculate the hash that is used as AES key?

Improve this question
$\endgroup$

2 Answers 2

Reset to default
0
$\begingroup$

Imagine two PBKDF2-SHA-512 hashes of the same password are generated. Each has individual salt. If an attacker had one hash and the salt of both hashes, would he be able to compute the missing hash or would he gain a significant advantage guessing it?

No. The idea of a hash is that it is impossible to reverse a hash. You can of course guess the hash then both outputs can be calculated, but having two different salts will not give any advantage to an attacker.

Note however that by performing PBKDF2 twice you are giving some advantage to an attacker, who only need to perform PBKDF2 once to verify correctness of a guess. Basically your advantage compared to the attacker is reduced by a single bit.

This is why you could also use PBKDF2 once and then create two values using a KBKDF such as HKDF(-expand) twice with two different labels. KBKDF's such as HKDF do not perform key strengthening so the work factor implied by PBKDF2 doesn't need to be performed twice on the server.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Or you double PBkDF2 output length and split it into two. (But that probably depends on the protocol if somebody should be able to derive both keys) $\endgroup$
    – eckes
    May 11, 2017 at 2:32
0
$\begingroup$

Imagine two PBKDF2-SHA-512 hashes of the same password are generated.
Each has individual salt. If an attacker had one hash and the salt of both hashes, would he be able to compute the missing hash or would he gain a significant advantage guessing it?

Probably. ​ ​ ​ There are presumably not too too many work-factors for the attacker to try (since you'd need to do at least that much work for each hash computation), so the adversary can try ​ work_factor , password ​ pairs with ​ [the salt for which the correct hash is known] ​ to probably get such a pair which produces the known hash. ​ ​ ​ When the attacker does get such a pair, using that pair with the other salt will probably yield the missing hash.


The other section of Maarten's answer is correct.

Improve this answer
$\endgroup$
3
  • $\begingroup$ The work factor is the same for every hash so the attacker already knows this and therefore only tries to find the correct password. But shouldn't the effort be equal to guessing the plaintext of a normal hash. The only difference would that I need twice the time due to the generation of two hashes instead of one. So the attacker only benefits because he only needs half the time I need. Or am I wrong? $\endgroup$
    – Birkenstab
    May 8, 2017 at 20:21
  • $\begingroup$ The effort will be only one hash-computation more than ​ "guessing the plaintext of a normal hash" , ​ since the attacker would crack one, and then use the preimage as the password for the other. ​ ​ ​ The benefit to the attacker is an ability to check their guesses. ​ ​ ​ (continued ...) ​ ​ ​ ​ ​ ​ ​ $\endgroup$
    – user991
    May 8, 2017 at 23:27
  • $\begingroup$ (... continued) ​ For example, if N is greater than 2 and the password was chosen uniformly at random from a set of N possible passwords, then with no known hash, the attacker's chance of guessing a missing hash would be only slightly greater than 2/N, but with a known hash, the attacker can probably rule out all but the correct password, so the attacker's chance of guessing the missing hash would be almost 1. ​ ​ ​ ​ $\endgroup$
    – user991
    May 8, 2017 at 23:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.