PBKDF2 で鍵を導出する方法
高い反復回数とソルトを持つ PBKDF2 を使って、パスワードから暗号鍵を導出します。
问题
ユーザーのパスワードから共通鍵を導出する必要がありますが、パスワードはエントロピーが低く、ストレッチングが必要です。
前提条件
- 鍵導出の理解
- ソルトと反復回数に関する知識
ステップ
-
1. Generate a random salt
Generate a cryptographically random salt of at least 16 bytes. The salt ensures that the same password produces different keys for different users or sessions. Store the salt alongside the derived key; it is not secret.
入力16 random bytes输出salt: a1b2c3... -
2. Choose an iteration count
Select an iteration count high enough to make brute force expensive. OWASP recommends at least 600,000 iterations for PBKDF2-HMAC-SHA256. Higher is more secure but slower. Tune based on your server's capacity.
入力iterations: 600000输出~500ms per derivation -
3. Derive the key
Run PBKDF2 with the password, salt, iteration count, and a PRF (HMAC-SHA256). The output is a deterministic key of the requested length. The same password and salt always produce the same key, but an attacker must repeat all iterations for each guess.
入力password + salt + 600000 iters输出32-byte derived key
期待される結果
総当たり攻撃の計算コストが高く、データの暗号化やパスワード検証に適した導出鍵。
よくあるエラー
- Iteration count too low
- Anything below 100,000 is too fast for modern GPUs. Use at least 600,000 for SHA-256 per OWASP 2023 guidance.
- Reusing the salt across users
- Generate a unique random salt per password. A shared salt enables multi-target attacks.
トラブルシューティング指引
- If derivation is too slow, reduce iterations or switch to a faster KDF like scrypt or Argon2 which are memory-hard.
- If you need to verify passwords, store the salt and iteration count with the derived key.
セキュリティ上の制限
- PBKDF2 is CPU-hard but not memory-hard, making it vulnerable to GPU/ASIC attacks. Consider scrypt or Argon2 for stronger resistance.
- All derivation is local.