Suppose I am using user passwords to derive AES-128-CBC encryption key. This key will be used to encrypt some sensitive data for the user so that even the website owner / operator can not decrypt it.

Then why should I use PBKDF2 over taking the first 128-bit of the SHA-512 output over the salt and password?

If I use PBKDF2, then what is recommended iterations nowadays for PBKDF2 at this date?

  • $\begingroup$ recommended iterations, 1 million or more $\endgroup$ – Richie Frame Nov 24 '19 at 9:13
  • $\begingroup$ PBKDF is a slow hash, usually used for storing passwords. HKDF is usually recommended to to derive the AES encryption key. $\endgroup$ – SamG101 Nov 24 '19 at 9:29

The problem with passwords or, more succinctly pass phrases, is that they are often relatively easy to guess. Password strength - or rather the lack of it - is a common problem. The strength of a password is not such a big deal if there is some kind of control over how the password can be used (e.g. a PIN is relatively easy, but you are only allowed 3 tries). However, if they are used to generate the key then the ciphertext is commonly believed to be accessible by an adversary, leaving the password guessing vulnerable to an uncontrolled offline attack.

Cryptographic hashes have been designed to be not just one way, but also to be rather fast. That simply means that for an adversary it is easy to test many inputs to derive the correct key. Generally it only takes very little time to test a key as well, since it is not required to decrypt a large amount of data with it; if the ciphertext is large then the adversary can still just decrypt a small part of it. So an adversary has to do a limited amount of work to find a key.

The iteration count - or more generally - the work factor is there to slow the adversary down. Any work that you do once for each password, the adversary has to do for each guess. That still only provides an additional amount of work compared to the situation with a cryptographic hash, but beggars cannot be choosers. So this is what passwords hashes or Password Based Key Derivation Functions have been designed to do: "strengthen" or "stretch" the password in such a way that they are relatively harder to guess.

As said, PBKDF's only provide limited protection against adversaries. Moreover, since ciphertext can be stored, the protection diminishes when faster computers become available. Attacks can also be very easily parallelized. So I would very much try and avoid password based encryption all together.

There are some ways of mitigating the problem of course. For one, you can use a password manager and a very complex password that has a similar strength of a secret key (say 96 bits or higher). That way you may not need a PBKDF to strengthen the password (although entering the password may become more cumbersome).

An other way of mitigating this is to encrypt a private key instead. Now you access to the private key to decrypt the ciphertext. You don't need access to it during encryption.

| improve this answer | |
  • 2
    $\begingroup$ No Argon2 suggestion? Not AEAD suggestion? $\endgroup$ – kelalaka Nov 24 '19 at 11:18
  • $\begingroup$ so to understand better you mean that the difference between sha-512 and PBKDF is that PBKDF has additional factor which is iteration that is used to slow attacker from guessing password? is that the only difference? does any of the algorithms affect the derived encryption key strength differently from the other? $\endgroup$ – mark820850 Nov 24 '19 at 12:53
  • $\begingroup$ Yes, although SHA-512 by itself doesn't use a salt either, and generally a PBKDF makes sure that e.g. the password and salt are separated correctly (not a huge problem, but yeah). You could say that the number of tries required goes up by $\log_2i$ where $i$ is the iteration count, so you could add that to the password strength to get to the key strength. Generally this is of course (far) below $2^{128}$ otherwise the key strength could be the limited by the key size of the symmetric cipher. And yes, kelalaka is right, use authentication encryption rather than CBC. $\endgroup$ – Maarten Bodewes Nov 24 '19 at 17:01
  • $\begingroup$ @MaartenBodewes authentication encryption? it is pretty new to me so would you please explaine what advantages it will give me? how is it better? what scenario? thank you a lot for your time $\endgroup$ – mark820850 Nov 24 '19 at 19:20
  • $\begingroup$ @kelalaka please explain to me what is the advantage of using AEAD ? and how to use it properly? what scenario? I am totally new to AEAD. thank you a lot for your time. $\endgroup$ – mark820850 Nov 24 '19 at 19:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.