Cómo a Derive Claves con PBKDF2
Derive un cryptographic clave de un contraseña usando PBKDF2 con un high iteration conteo y salt.
问题
You necesitar a derive un symmetric clave de un usuario contraseña, pero passwords son low-entropy y necesitar stretching.
Requisitos previos
- Understanding of key derivation
- Knowledge of salt and iteration count
Pasos
-
1. Generate a random salt
Generate a cryptographically random salt of at least 16 bytes. The salt ensures that the same password produces different keys for different users or sessions. Store the salt alongside the derived key; it is not secret.
entrada16 random bytes输出salt: a1b2c3... -
2. Choose an iteration count
Select an iteration count high enough to make brute force expensive. OWASP recommends at least 600,000 iterations for PBKDF2-HMAC-SHA256. Higher is more secure but slower. Tune based on your server's capacity.
entradaiterations: 600000输出~500ms per derivation -
3. Derive the key
Run PBKDF2 with the password, salt, iteration count, and a PRF (HMAC-SHA256). The output is a deterministic key of the requested length. The same password and salt always produce the same key, but an attacker must repeat all iterations for each guess.
entradapassword + salt + 600000 iters输出32-byte derived key
Resultado esperado
Un derived clave ese es computationally expensive a brute force, suitable para encrypting datos o verifying passwords.
Errores comunes
- Iteration count too low
- Anything below 100,000 is too fast for modern GPUs. Use at least 600,000 for SHA-256 per OWASP 2023 guidance.
- Reusing the salt across users
- Generate a unique random salt per password. A shared salt enables multi-target attacks.
Solución de problemas指引
- If derivation is too slow, reduce iterations or switch to a faster KDF like scrypt or Argon2 which are memory-hard.
- If you need to verify passwords, store the salt and iteration count with the derived key.
Límites de seguridad
- PBKDF2 is CPU-hard but not memory-hard, making it vulnerable to GPU/ASIC attacks. Consider scrypt or Argon2 for stronger resistance.
- All derivation is local.