Is there any sort of practical advantage to using a stretching algorithm such as PBKDF2 on say SHA256 over a straight SHA512 hash?

If the purpose of key stretching is to increase the length and thus prevent any shortcuts in cracking short keys, is there still a purpose when it is fairly easy to generate keys of lengths that make them close to impossible to brute force?


The purpose of key stretching is to increase the strength of the resulting output keying material, compared with the input keying material. The input of the keying material is of course generally a password. If the strength of the keying material is already high enough then there is not need to stretch the keys.

Note that the word "length" is in this case a bit of a misnomer. "This is a very secure password" is obviously not a very strong passphrase, even though it probably exceeds the length requirements of many (badly programmed) systems.

PBKDF2 also has a salt component to it which makes it possible to derive keys that also depend on a unique salt, which makes sure that if it is used multiple times with a different salt that it produces different keys. This is an advantage of PBKDF2 against a secure hash.

It seems that you want to use SHA-256 for deriving keys however. For this purpose there are other algorithms that are closely related to PBKDF's: KBKDF's.

A PBKDF is an algorithm where a key is derived from a password, while KBKDF's derive directly from a key that already has enough strength. The strength of the input key is directly transferred to the output keying material (to a certain high maximum, depending on the KBKDF algorithm that is chosen).

As with PBKDF2 it is not required that the randomness in the input keying material is well distributed, so it could for instance be the output of an asymmetric calculation that doesn't provide this distribution.

KBKDF's have some advantages over secure hashes, as they have been especially designed for this functionality:

  • they can use additional diversification data, e.g. the ASCII encoding of "ENC" and "MAC" to derive multiple keys;
  • they often have an input parameter for a salt;
  • they often have a configurable output key length;
  • they can be implemented in cryptographic hardware where the input / output key are kept inside the hardware, without being exposed to the outside world.

The most modern, standardized KBKDF is HKDF, which itself is based on HMAC, and HMAC in turn is based on - you'd guess it - a (reasonably) secure hash.

You could use PBKDF2 as a poorly designed KBKDF, and similarly you could use a hash yourself to create a poorly designed KBKDF. But I'd just use HKDF. It would seem from the question that you'd need the full HKDF by the way, HKDF-extract and -expand.

If you're faced with a direct choice of using a PBKDF2 with SHA-256 over SHA-512, I would say that it doesn't make too much of a difference, especially if you can set the iteration count to 1. I'd choose PBKDF2 as it was at least designed for this purpose and you can tweak it with a salt and generate as many output bits as required, using a standardized algorithm.

That would however be after indicating that a KBKDF should be used instead.

| improve this answer | |
  • $\begingroup$ One problem is that KBKDF's are one of the most ignored cryptographic functions, possibly because they are so easy to create or not even named (e.g. the term PRF is used in the TLS specifications). So they are often missing from cryptographic API's and even HSM's which have been especially created for key management. That HSM's still haven't all implemented HKDF is a clear indication how stale that market really is. You may have to implement them yourself on top of HMAC. $\endgroup$ – Maarten Bodewes Nov 16 '17 at 18:53

There is a definite advantage of PBKDF2 with any SHA hash over a straight SHA512 hash when dealing with password derivation or password verifiers.

The purpose of PBKDF2 is not only stretching but more importantly to iterate a number of rounds, to require a substantial amount of CPU usage, in order to substantially slow down a brute force attack. It is fairly common to use a rounds count such that ~100ms of CPU time is used.

Given that average system can hash a password with SHA-256 in ~1us using PBKDF2 with a ~100ms round count slows down an attacker by a factor of ~$10^{5}$.

| improve this answer | |
  • 1
    $\begingroup$ If I understood correctly then stretching means stretching the strength of the resulting hash. Key stretching is not used to increase the length but the strength of the generated keying material. This is performed by the work factor within the password hashing algorithm, which in the case of PBKDF2 is indeed the linear iteration count. $\endgroup$ – Maarten Bodewes Nov 16 '17 at 10:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.