# How to reverse engineer Salt from password, iterations, and key?

Let's say that a random key is derived using the following function (PBKDF2).

key = fn(password, salt, iterations)


Q1: How can I reverse engineer the salt from the password, iterations, and the key?

Q2: If the same salt is used for generating the key, how can I reverse engineer the salt from the password, iterations, and the key?

• Brute force (good luck with that as the recommended minimum salt length for PBKDF2 is 16 bytes) But in the real world the salt is not a secret so there's no need to try to find it, it's the key that's the secret. Sep 17, 2021 at 21:12
• Even with Brute force, how difficult it can get? Sep 17, 2021 at 21:15
• I don't understand how the second question is different from the first. You say "same salt", but what's it the same as? Sep 18, 2021 at 9:52
• @GordonDavisson A fixed salt is used to derive the keys. However, a new password and iteration are generated every time. So the question really is that if or how the salt can be reverse engineered by mining the password, iterations, and the key? Sep 18, 2021 at 12:32