PBKDF2: Strengthening Password Security with Key Stretching

 PBKDF2

PBKDF2, which stands for "Password-Based Key Derivation Function 2," is a widely used cryptographic technique for securely deriving a cryptographic key from a user's password, essentially turning a relatively easy-to-guess password into a strong encryption key by adding a random salt and repeatedly applying a hashing function multiple times (iterations). This makes brute-force attacks significantly harder to execute; this process is known as "key stretching" and is crucial for protecting stored passwords in systems like websites and applications.

Key points about PBKDF2

• Purpose: To transform a password into a secure cryptographic key that can be used for encryption and decryption operations.
• Salting: A random string called a "salt" is added to the password before hashing. This ensures that even if two users have the same password, their derived keys will differ due to the unique salt.
• Iterations: The hashing process is applied repeatedly for a specified number of times (iterations), significantly increasing the computational cost of cracking the password.
• Underlying Hash Function:
• PBKDF2 typically uses an HMAC (Hash-based Message Authentication Code) with a secure hash function like SHA-256 or SHA-512 as its underlying cryptographic primitive.

How PBKDF2 works:

1. Input:

The user's password, a randomly generated salt, and the desired number of iterations.

2. Hashing with Salt:

The password is combined with the salt and run through the chosen hash function once.

3. Iteration Loop:

The output from the previous step is repeatedly re-hashed with the salt for the specified number of iterations.

4. Derived Key:

The final output of the iteration loop is the derived cryptographic key, which can be used for encryption and decryption operations.

Benefits of PBKDF2:

• Stronger Password Security:
• By making password cracking significantly slower due to the iteration process, PBKDF2 protects against brute-force attacks.
• Salt Protection:
• Adding a unique salt prevents rainbow table attacks, where precomputed hashes of common passwords are used to quickly crack passwords.
• Standard Implementation:
• PBKDF2 is a widely recognized standard, making it easy to implement across different programming languages and platforms.

Important Considerations:

• Iteration Count: It is crucial to choose the appropriate number of iterations. Higher iteration counts provide better security but also increase the computational cost.
• Salt Storage: The salt must be securely stored alongside the hashed password to ensure proper key derivation.
• Modern Alternatives: While PBKDF2 is a robust standard, newer key derivation functions like scrypt and Argon2 may offer further security benefits depending on specific requirements.

This is covered in CompTIA Pentest+ and Security+.

Key Stretching - Protecting Passwords

 Key Stretching

Key stretching is a way of slowing the attacker down from discovering a password in a hashed format. This method uses thousands of rounds of hashing. It first hashes the password, then hashes the hash, and continues this process.

The attacker would have to guess the password and start the hashing process by testing each hash until they find a match.

There are two main methods of key stretching: bcrypt & PBKDF2 (Password-Based Key Derivation 2)

Protecting Passwords Against Offline Attacks

 Offline Password Attacks & Preventive Measures

Rainbow table attack

The best protection against this attack type is adding salt (random data) to the password before hashing.

Brute Force & Dictionary

The best method for slowing down the attacker from discovering the password is to use key stretching. This method uses thousands of rounds of hashing. This does not make the key stronger, but the attacker has to do a lot of processing to check each possible key to find the correct one. There are 2 methods on the exam:

PBKDF2 & bcrypt