LastPass is a password manager that I am sure many of you are familiar with. I have been studying LastPass's source code a bit. From their FAQs and what I can gather from their source code, the way they derive and store your encryption key is as follows:
The client application derives your encryption key using standard PBKDF2 with your master password, a variable number of iterations (5000 is the default, but you can set whatever you like), and your email address as the salt.
The resulting encryption key is used for encrypting and decrypting your vault information.
For the purposes of authentication with their servers, they then take that encryption key and hash it using PBKDF2 again, this time using the previously generated encryption key as the password input and the user's master password as the salt. This is done with just 1 iteration.
The resulting hash is then transmitted to the LastPass servers where (according to their FAQs since I cannot see their server source code) they again use standard PBKDF2 with a random salt and 100,000 iterations.
pbkdf2(algorithm, password, salt, iterations, bytes)
enc_key = pbkdf2(sha256, master_password, email, client_iterations, 32) key_hash = pbkdf2(sha256, enc_key, master_password, 1, 32)
stored_hash = pbkdf2(sha256, key_hash, random_bits, 100000, 32)
I am confused about the key hashing process that they are doing. It appears that they are using PBKDF2 as a means for computing a SHA256 hash to protect it during transmission to their servers.
- Can you explain what using PBKDF2 with 1 iteration is doing in the above?
- Is this the same as just doing something like a HMAC SHA256 hash?
- Are there any concerns with something like a compromised server receiving this hash and being able to derive anything from it about the original encryption key or master password (prior to the stored hash being computed)?