The Password-Based Key Derivation Function 2 (PBKDF2) is a method of securely deriving encryption keys from a passphrase entered by a user. It features an iteration count that can be deliberately adjusted (key stretching) to slow down brute force password guessing attacks.
The Password-Based Key Derivation Function 2 (PBKDF2) is a method of securely deriving encryption keys from a passphrase entered by a user.
PBKDF2 was published by RSA Laboratories as part of the PKCS #5 v2.0 standard (also published by the IETF as RFC 2898), replacing an earlier, less flexible method (still supported but deprecated) now known as PBKDF1.
The PBKDF2 construction is based on a pseudorandom function (PRF), and it can be proven secure assuming the security of the underlying PRF. A common choice for the PRF is HMAC, which in turn is a construction based on a cryptographic hash function, and can be proven secure given some fairly weak security assumptions on the hash. Thus, a typical instance of PBKDF2 might be e.g. PBKDF2-HMAC-SHA256, meaning PBKDF2 instantiated with HMAC, which in turn is instantiated with the SHA-256 hash function.
The PBKDF2 construction notably features an adjustable iteration count, which can be used to control the speed of the key derivation process. For typical uses, PKCS #5 recommends an iteration count of at least 1000 (although this should be increased as computers become faster), making PBKDF2 at least a thousand times slower than simply hashing the passphrase with the underlying PRF. Such deliberate slowing down is known as key stretching, and can be useful in hindering brute force password guessing searches. PBKDF2 also allows and recommends the use of a random salt, intended to thwart attacks using precompiled password tables and to ensure that the derived keys are unique and effectively independent even if the same passphrase is used to derive keys for multiple purposes.
PBKDF2 can be used to derive keys for all kinds of cryptographic purposes, not just for symmetric encryption. In particular, it has become a popular recommendation for password hashing for websites and on-line applications, as it provides the important features of salting and key stretching in a standardized and well studied package.
See also:
- kdf – key derivation functions in general
- bcrypt – an alternative password hashing method that implements key stretching
- scrypt – a more recent alternative to PBKDF2, which also allows the memory consumption of the algorithm to be adjusted to thwart parallel password cracking using GPUs or dedicated hardware
