Let me start by explaining my understanding of the various concepts involved in this question:
Salt: Random bytes of data used as secondary input for a password hashing function, like so:
hashfunc(<password>, <salt>) -> <hash>
And both the
<hash>as well as the
<salt>that was used are then stored (in a database, for example).
This prevents attacks using rainbow tables, making it more difficult for an attacker who has access to the output of the hash function (
<hash>) to deduce the original
Key derivation function: A function that takes a password
<password>and an integer
<size>as input, and generates arbitrary bytes of the desired
<size>as output, like so:
kdf(<password>, <size>) -> <bytes of length <size>>
This allows us to turn a plain-text password like "admin123" into a key of a certain size that can be used by other cryptographic functions (like AES encryption, which requires a key of size 32).
So if my understanding is correct, then key derivation functions have no use for a salt. After all, the derived key isn't intended to be stored - it'll be used as input for another cryptographic function, and then it'll simply be discarded. Unless someone steals the derived key from the computer's memory in this short time frame, there is no risk of a rainbow table attack.
And yet, according to wikipedia, the PBKDF2 key derivation function takes a salt as input:
The PBKDF2 key derivation function has five input parameters:
DK = PBKDF2(PRF, Password, Salt, c, dkLen)
What purpose does this salt serve? Did I misunderstand the purpose of key derivation functions?
- PBKDF2 and salt does not answer my question because the answers seem to assume that the derived key will be stored, which, according to my understanding of key derivation functions, should never happen.