If I have a password pwd
, and I hash it with SHA256
and send it to a server for authentication (server will apply bcrypt
for storage), and then I use PBKDF2-SHA256
with a large number of iterations to derive a key for decrypting user data, does the fact that the server knows the original SHA256
hash or the bcrypt
hash allow it to derive the original pwd
or the decryption key?
Another way to phrase the question: see below pseudocode
CLIENT:
hash1 := SHA256(email + pwd)
> send hash1 to server
SERVER:
hash2 := bcrypt(hash1)
if hash2 == stored expected value; send data and salt back to client
CLIENT
key := pbkdf2(email + pwd, salt, ...)
AES.decrypt(data, key)
In my scenario, the SERVER
is a third party. If, say, the server went rogue and tried to steal all of the users' data, would the server be able to do so easily, knowing about the contents of hash1
and salt
?
P.S.: Does 5 million iterations somehow weaken PBKDF2 (hash cycles, etc.)?
pwd
is a bad password, it can be found very quickly by a malicious server. $\endgroup$