3
$\begingroup$

For example, let's say I did 1,000,000 rounds of PBKDF2 on some string (along with a high entropy salt).

If I then run the result plus some string through a simple SHA512 hash function, is it still secure due to the amount of work put into it, or has it lost something?

Example:

var x = pbkdf2(someSalt, somePass, 1000000);
var y = sha512(x + someString);

Is y safe?

Improve this question
$\endgroup$
3
  • $\begingroup$ Still possibly vulnerable to length-extension attack. If this is meant to be a keyed hash, best to use HMAC. $\endgroup$
    – user13741
    Commented Jan 14, 2018 at 1:41
  • 1
    $\begingroup$ Please define safe. What should be impossible for an attacker under what assumptions? $\endgroup$
    – SEJPM
    Commented Jan 14, 2018 at 10:32
  • 1
    $\begingroup$ @SEJPM: That it's just as difficult to break x as it is y. Is y less secure than x in any way? $\endgroup$
    – Indoor Picnic
    Commented Jan 14, 2018 at 13:59

1 Answer 1

Reset to default
2
$\begingroup$

Theoretically this provides less collision resistance than straight SHA-512 hashing or straight PBKDF2 hashing. The reason is that if you can find a collision in either function, you can either make the input to SHA-512 the same or can (potentially, even though it's practically very hard) exploit the collision in SHA-512.

Practically however, collision resistance stays the same, which is "unbreakable", as we don't know a way to break SHA-512 in that regard, nor do we know how to break the collision resistance of PBKDF2.

As for password-hashing, the application which seems most likely here, the additional hash won't make the construction weaker, as you still have to do the 1M rounds of hashing to get to the relevant SHA-512 input. Note however that using PBKDF2 for password hashing is strongly discouraged in all but the most extreme cases due to much better and stronger alternatives like Argon2 and bcrypt being available.

Improve this answer
$\endgroup$
1
  • 3
    $\begingroup$ Not like it matters in practice, but PBKDF2 is neither collision resistant nor second-pre-image resistant. (Append zero to a password shorter than the block-size or hash a password longer than block-size to get an equivalent password). Longer explanation $\endgroup$
    – CodesInChaos
    Commented Jan 14, 2018 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.