Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Let's say that a random key is derived using the following function (PBKDF2).
key = fn(password, salt, iterations)
Q1: How can I reverse engineer the salt from the password, iterations, and the key?
Q2: If the same salt is used for generating the key, how can I reverse engineer the salt from the password, iterations, and the key?
PBKDF2 is based on HMAC using a cryptographically secure hash function. Assuming the hash function is secure, the easiest approach will be brute force. Assuming you know the password, then the difficulty is the amount of entropy in the salt. So if you picked 16 random bytes, that provides 128 bits of entropy, and you'll require more energy than is required to boil all the world's oceans. 16 or 32 random bytes are customary amounts of salt to use when no other guidelines are given, both of which will be computationally infeasible to guess.
In general, we don't consider salt to be secret. It is generally stored along with the iteration count in plaintext when storing passwords, and in cryptographic protocols like TLS and SSH, the salt is sent in plaintext as part of the cryptographic negotiation.
