PBKDF2 Key Derivation

About PBKDF2

PBKDF2 (Password-Based Key Derivation Function 2) is a password-based key derivation function, published by RSA Laboratories in 2000 as part of PKCS#5 v2.0 and later adopted by the IETF as RFC 2898 / RFC 8018. It hashes the password together with a random salt over and over (the pseudo-random function is usually HMAC-SHA1 or HMAC-SHA256) to produce a derived key (DK) of fixed length.

Unlike storing a plain hash, PBKDF2 uses an adjustable iteration count to deliberately make the computation expensive, which drives up the cost of brute-force and dictionary attacks. More iterations means stronger security and a longer wait. NIST currently recommends a minimum of 600,000 iterations (HMAC-SHA256) or 1,300,000 (HMAC-SHA1).

What the salt is for

A salt is a piece of random data mixed into the password before derivation, so that two users with the same password still end up with completely different derived keys. That is what defends against precomputed rainbow tables. The salt does not need to be secret and is normally stored alongside the derived key. Use a random salt of at least 16 bytes (128 bit).

Key size

The key size decides how long the output is: 128 bit gives 32 hexadecimal characters, 256 bit gives 64, 512 bit gives 128 and 1024 bit gives 256. Pick the length that matches what you need it for (AES-128, AES-256 and so on).

Where it is used

PBKDF2 is used widely for: password storage (the server keeps the derived value instead of the password itself), disk encryption (macOS FileVault, iOS data protection, Wi-Fi WPA2 key derivation), and building a symmetric encryption key out of a password.