Wie in Derive Schlüssel mit PBKDF2

问题

You brauchen in derive ein symmetric Schlüssel von ein Benutzer Passwort, aber passwords sind low-entropy und brauchen stretching.

Voraussetzungen

• Understanding of key derivation
• Knowledge of salt and iteration count

Schritte

1. 1. Generate a random salt

   Generate a cryptographically random salt of at least 16 bytes. The salt ensures that the same password produces different keys for different users or sessions. Store the salt alongside the derived key; it is not secret.

   Eingabe

   16 random bytes

   输出

   salt: a1b2c3...

2. 2. Choose an iteration count

   Select an iteration count high enough to make brute force expensive. OWASP recommends at least 600,000 iterations for PBKDF2-HMAC-SHA256. Higher is more secure but slower. Tune based on your server's capacity.

   Eingabe

   iterations: 600000

   输出

   ~500ms per derivation

3. 3. Derive the key

   Run PBKDF2 with the password, salt, iteration count, and a PRF (HMAC-SHA256). The output is a deterministic key of the requested length. The same password and salt always produce the same key, but an attacker must repeat all iterations for each guess.

   Eingabe

   password + salt + 600000 iters

   输出

   32-byte derived key

Erwartetes Ergebnis

Ein derived Schlüssel das ist computationally expensive in brute force, suitable für encrypting Daten oder verifying passwords.

Häufige Fehler

Iteration count too low

Anything below 100,000 is too fast for modern GPUs. Use at least 600,000 for SHA-256 per OWASP 2023 guidance.

Reusing the salt across users

Generate a unique random salt per password. A shared salt enables multi-target attacks.

Troubleshooting指引

• If derivation is too slow, reduce iterations or switch to a faster KDF like scrypt or Argon2 which are memory-hard.
• If you need to verify passwords, store the salt and iteration count with the derived key.

Sicherheitsgrenzen

• PBKDF2 is CPU-hard but not memory-hard, making it vulnerable to GPU/ASIC attacks. Consider scrypt or Argon2 for stronger resistance.
• All derivation is local.