Assume the threat model here is that the server is not to be trusted and the client is trusted. A user registers for an account and the client chooses an iteration count of 50,000 to generate a 512 bit key for the user.
The key is then split in half: the first half is kept locally as the encryption key, and the second half is sent to the server as the user's "password".
key = pbkdf2(password: inputted_password, salt: some_salt, cost: 50000, size: 512) encryption_key = key.first_half server_password = key.second_half
server_password is sent to the server to authenticate.
Assume now that on some subsequent login session, the client is tricked by some irrelevant means into computing
server_password using a lower iteration count of 3,000 instead of the real value of 50,000.
So the client is tricked into using a lower cost:
key = pbkdf2(password: inputted_password, salt: some_salt, cost: 3000, size: 512) server_password = key.second_half
server_password is sent to the server.
My question is, does this "weaker" derived password leak any information to the server on what the nature of the user's original inputted password is?