If I have a password
pwd, and I hash it with
SHA256 and send it to a server for authentication (server will apply
bcrypt for storage), and then I use
PBKDF2-SHA256 with a large number of iterations to derive a key for decrypting user data, does the fact that the server knows the original
SHA256 hash or the
bcrypt hash allow it to derive the original
pwd or the decryption key?
Another way to phrase the question: see below pseudocode
CLIENT: hash1 := SHA256(email + pwd) > send hash1 to server SERVER: hash2 := bcrypt(hash1) if hash2 == stored expected value; send data and salt back to client CLIENT key := pbkdf2(email + pwd, salt, ...) AES.decrypt(data, key)
In my scenario, the
SERVER is a third party. If, say, the server went rogue and tried to steal all of the users' data, would the server be able to do so easily, knowing about the contents of
P.S.: Does 5 million iterations somehow weaken PBKDF2 (hash cycles, etc.)?