Would it make sense to use Bcrypt and PBKDF2 together?

Question

I've read various opinions about whether Bcrypt or PDBKF2 is a better key derivation hashing method. The answer seems to depend on a lot of complicated factors that are not easy to analyze. Would using both of them (presumably in a serial way one before the other) accrue the benefits of both and thus achieve an optimally secure solution?

Answer 1

Mixing the two functions would not really help. Bcrypt and PBKDF2 both have a configurable cost: you are supposed to set the number of iterations at the maximum value which is still tolerable in your situation, given the available hardware and the environmental constraints (e.g. average user patience). If you want to use both function together, then they must share the same CPU budget; in other words, you would have to decrease the number of iterations compared to what you would use in either function alone.

So you do not get something stronger that way; instead, you get a security level which is an average of what you would have got with Bcrypt alone, or with PBKDF2 alone.

Combining two hash functions or similar functions together is good to avoid a catastrophic failure, if one turns out to be broken; but, assuming that both Bcrypt and PBKDF2 are strong, and the question is mostly about performance (both bcrypt and PBKDF2 are about making exhaustive search slower, so this is all about performance). For optimal slowness, combining bcrypt and PBKDF2 is not a good idea.

For the choice between bcrypt and PBKDF2, see this previous answer. To sum things up:

• Bcrypt is better if your hardware is PC-like (i.e. has several kilobytes of RAM with fast access). It is harder for the attacker to optimize exhaustive search with a GPU, if bcrypt is used, compared to PBKDF2.

• PBKDF2 has NIST's blessing (it is Approved, with a big 'A'). NIST says nothing about bcrypt.

• Bcrypt outputs 192 bits, which is fine for a password verification token, or if you just need 192 bits (or less) of password-derived key material. On the other hand, PBKDF2 is a key derivation function and can produce as many bits as you wish, which is good if you need more than 192 bits of key material.