S2K is a KDF designed for the OpenPGP standard which concatenates a password and salt and feeds this, repeating, into a hash function for a configurable number of bytes. PBKDF2 is a KDF which uses a hash function in HMAC mode and iterates it a configurable number of times over previous output.

Assuming optimizations for PBKDF2 are used (precomputing the hash state for the inner and outer key), is there any difference in security between S2K and PBKDF2 if they both are made to require the same number of hash compressions? For example, does one of the schemes rely on stronger assumptions about the underlying hash, or is one slower than the other even for the same number of compressions?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.