# Does having an SHA256 hash compromise PBKDF2 secrecy?

If I have a password pwd, and I hash it with SHA256 and send it to a server for authentication (server will apply bcrypt for storage), and then I use PBKDF2-SHA256 with a large number of iterations to derive a key for decrypting user data, does the fact that the server knows the original SHA256 hash or the bcrypt hash allow it to derive the original pwd or the decryption key?

Another way to phrase the question: see below pseudocode

CLIENT:
hash1 := SHA256(email + pwd)
> send hash1 to server

SERVER:
hash2 := bcrypt(hash1)
if hash2 == stored expected value; send data and salt back to client

CLIENT
key := pbkdf2(email + pwd, salt, ...)
AES.decrypt(data, key)


In my scenario, the SERVER is a third party. If, say, the server went rogue and tried to steal all of the users' data, would the server be able to do so easily, knowing about the contents of hash1 and salt?

P.S.: Does 5 million iterations somehow weaken PBKDF2 (hash cycles, etc.)?

• Yes, a single round of SHA-256 allows for extremely fast brute-forcing. That is if pwd is a bad password, it can be found very quickly by a malicious server. – SEJPM Aug 2 '18 at 17:09
• Well now I know not to develop security-related ideas when I haven’t got enough sleep 🤦🏼‍♂️ – Potassium Ion Aug 2 '18 at 17:13
• Related question about a curiously similar scenario (but without the client-side key derivation part): crypto.stackexchange.com/questions/6280/… – Ilmari Karonen Aug 2 '18 at 18:58
• @IlmariKaronen Saw that one. But I was thinking more along the lines of if knowing a SHA256 hash weakens the pbkdf2. But regardless the hash can be just brute forced anyway defeating the purpose of the iteration count of the pbidf2. – Potassium Ion Aug 2 '18 at 19:01

If the party that controls the server also controls the client application then the server will always be able to retrieve the password. In that sense protecting against the server only works if very strict auditing is taking place, and then only maybe.

If the server receives a hash over the password then it can of course perform a (augmented) dictionary attack against the hash. When multiple hashes are collected then rainbow tables will also be an option. All the additional protection delivered by bcrypt of PBKDF2 will be null and void.

So yes, if the password could be found with an attack, and then PBKDF2 can be performed using the found password in your scheme. Very strong password will still offer protection against the server, of course.

PS No, the more iterations the better for PBKDF2. Cycles only occur after many more iterations, and are nothing to worry about here.