1
$\begingroup$

Is using AES GCM with PBKDF2 and 100 000 iterations still considered secure as of 2022?

In our threat model, if we ignore the risks linked to quantum computing, is this secure?

Here is an example working Python implementation:

import Crypto.Random, Crypto.Protocol.KDF, Crypto.Cipher.AES
plaintext = b"hello world hello world hello world hello world hello world"
password = b"correct horse battery staple"
nonce = Crypto.Random.new().read(16)
key = Crypto.Protocol.KDF.PBKDF2(password, nonce, count=100000)
cipher = Crypto.Cipher.AES.new(key, Crypto.Cipher.AES.MODE_GCM, nonce=nonce, mac_len=16)
ciphertext = (nonce,) + cipher.encrypt_and_digest(plaintext)  # nonce | ciphertext | tag
print(ciphertext)

Note: using the same nonce for PBKDF2 and AES.new(...) seems not to be a problem if we never re-use this nonce for future encryptions, see Reusing PBKDF2 salt for AES/GCM as IV: dangerous?

$\endgroup$
7
  • 1
    $\begingroup$ What qualities does it require for it to be "still OK" for your threat model? It's better to use a memory-hard KDF because PBKDF2 is easy to parallelize, but it's not like it's broken. $\endgroup$
    – forest
    Apr 25, 2022 at 20:12
  • $\begingroup$ @forest By "OK", let's say resistant to an attacker who has 1 million $ budget of computing power as of 2022 for the specific task of cracking a given password-protected file :) (and no access to quantum computing). $\endgroup$
    – Basj
    Apr 25, 2022 at 20:17
  • 2
    $\begingroup$ Then it depends on how strong the password is. 100,000 rounds of PBKDF2 for a given hash adds $\log_2(100000) \approx 16.6$ bits of entropy compared to a single round of that hash. If the password itself is already very strong, then you don't even need PBKDF2. The only purpose of a slow KDF is to improve the security of passwords of marginal strength. If your password has only, say, 64 bits of entropy, then 1000,000 iterations would likely put it out of reach of the attacker you described. $\endgroup$
    – forest
    Apr 25, 2022 at 20:21
  • $\begingroup$ @forest Let's say the passwords are 10 random looking alphanumeric characters (a-zA-Z0-9). Does 100k iterations of PBKDF2 make it out of reach of attackers nowadays? PS: I think your last comment can be turned into the answer. $\endgroup$
    – Basj
    Apr 26, 2022 at 7:46
  • $\begingroup$ You can do the calculations yourself, see e.g. here. So ~59.5 + ~16.6 = 76.1 bits of security, but that's assuming that the password is fully random, not just random looking to an attacker. Note that above is based on the full search, so you have 1 bit less security on average (I should have removed that one bit really). $\endgroup$
    – Maarten Bodewes
    Apr 26, 2022 at 12:33

1 Answer 1

4
$\begingroup$

It depends entirely on how strong the password is. 100,000 rounds of PBKDF2 for a password with a given hash adds the equivalent of $\log_2(100000) \approx 16.6$ bits of entropy compared to a single round of that hash. If the password itself is already very strong, then you don't even need PBKDF2. The only purpose of a slow KDF is to improve the security of passwords of marginal strength. If your password has only, say, 64 bits of entropy, then 1000,000 iterations would likely put it out of reach of an attacker with \$1M of assets, because 64 + 16.6 = 80.6 bits, which would likely cost more than \$1M to break.

It's better to use a memory-hard KDF. This isn't because PBKDF2 is broken per se, but is because an attacker can more easily scale up an attack due to hashing lending itself to extreme parallelism.

$\endgroup$
2
  • $\begingroup$ Can you recommend any "memory-hard" algos that are widely used today and/or certified by some standards organization or government? $\endgroup$
    – Slbox
    Oct 4, 2022 at 22:43
  • $\begingroup$ @Slbox You should be using Argon2. An older algorithm that is also acceptable is bcrypt, but it's not nearly as good (it helps protect against GPUs, whereas Argon2 protects against GPUs and ASICs). $\endgroup$
    – forest
    Oct 6, 2022 at 23:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.