# Do PBKDF2 keys generated at a lower iteration count leak information?

Assume the threat model here is that the server is not to be trusted and the client is trusted. A user registers for an account and the client chooses an iteration count of 50,000 to generate a 512 bit key for the user.

The key is then split in half: the first half is kept locally as the encryption key, and the second half is sent to the server as the user's "password".

encryption_key = key.first_half

server_password is sent to the server to authenticate.

Assume now that on some subsequent login session, the client is tricked by some irrelevant means into computing server_password using a lower iteration count of 3,000 instead of the real value of 50,000.

So the client is tricked into using a lower cost:

and this server_password is sent to the server.

My question is, does this "weaker" derived password leak any information to the server on what the nature of the user's original inputted password is?

server_password can take much more values ($2^{256}$) than inputted_password can be tested, and PBKDF2 behaves like a random function, thus the first inputted_password found matching (if any) is the true one with overwhelming certainty.