如何Derive 关键具有 PBKDF2
Derive cryptographic 键从 password using PBKDF2 具有高 迭代数量和 salt.
问题
你需要derive symmetric 键从 用户 password, 但 passwords 是 low-entropy 和 need stretching.
前置条件
- Understanding 的键 derivation
- Knowledge 的 salt 和迭代数量
步骤
-
1. Generate a random salt
Generate a cryptographically random salt of at least 16 bytes. The salt ensures that the same password produces different keys for different users or sessions. Store the salt alongside the derived key; it is not secret.
输入16 random bytes输出salt: a1b2c3... -
2. Choose an iteration count
Select an iteration count high enough to make brute force expensive. OWASP recommends at least 600,000 iterations for PBKDF2-HMAC-SHA256. Higher is more secure but slower. Tune based on your server's capacity.
输入iterations: 600000输出~500ms per derivation -
3. Derive the key
Run PBKDF2 with the password, salt, iteration count, and a PRF (HMAC-SHA256). The output is a deterministic key of the requested length. The same password and salt always produce the same key, but an attacker must repeat all iterations for each guess.
输入password + salt + 600000 iters输出32-byte derived key
预期结果
derived 键该 是 computationally expensive 到 brute force, suitable 为 encrypting 数据或 verifying passwords.
常见错误
- Iteration count too low
- Anything below 100,000 is too fast for modern GPUs. Use at least 600,000 for SHA-256 per OWASP 2023 guidance.
- Reusing the salt across users
- Generate a unique random salt per password. A shared salt enables multi-target attacks.
排障指引
- If derivation is too slow, reduce iterations or switch to a faster KDF like scrypt or Argon2 which are memory-hard.
- If you need to verify passwords, store the salt and iteration count with the derived key.
安全限制
- PBKDF2 is CPU-hard but not memory-hard, making it vulnerable to GPU/ASIC attacks. Consider scrypt or Argon2 for stronger resistance.
- All derivation is local.