DK = PBKDF2(PRF, Password, Salt, c, dkLen)
When PBKDF2 is used for key derivation (not password hashing), is it possible for an adversary who doesn't know Password
to learn anything about Salt
when given DK
?
Edit
To clarify this question a bit, let's fix c
and dkLen
and simplify the function a bit:
DK = PBKDF2(PRF, Password, Salt)
This function has 3 inputs and 1 output. When given PRF
, Password
and Salt
, we can calculate DK
exactly.
My question is actually very simple:
When given PRF
and DK
, is it possible for an adversary to learn anything about Salt
?
Here are some trivial examples that may help you understand the question better:
If we define
function1(PRF, Password, Salt) = Password
, then obviously the adversary won't learn anything aboutSalt
because it's not being used.If we define
function2(PRF, Password, Salt) = Salt
, then obviously the adversary will learn something (everything, in fact) aboutSalt
.
The parameter name Salt
may be confusing because we are not using it as a salt here. Instead, it's some information that we want to keep a secret. This may or may not be its original design goal. But I'd simply like to know whether it's safe to use PBKDF2 in this way.
DK
. We just want to protectSalt
even when the attacker happens to knowDK
. In our use case, that parameter is actually not used as a salt here. I just wrote the function as Wiki presents it. See EDIT. $\endgroup$ – Cyker Jul 7 '18 at 2:15