Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We hesitated between BCrypt and PBKDF2 for password hashing. In many forums and blogs people say something like "In their Special Publication SP 800-132 NIST basically recommends using PBKDF2 for password hashing."

This may be a very important argument for our client (they adore standards). But I still cannot read this recommendation in plain text... So I can't claim it comfortably. In short NIST more or less say:

The derived keying material is called a Master Key (MK), denoted as mk. The MK is used either 1) to generate one or more Data Protection Keys (DPKs) to protect data, or 2) to generate an intermediate key to protect one or more existing DPKs or generated from the MK using an approved Key Derivation Function (KDF) as defined in [2]. The MK shall not be used for other purposes.

Is there such a recommendation or this is just a myth?

share|improve this question
The NIST paper is related to algorithms for derivation of a key from a password. You only refer to "password hashing" which is not the same thing. Can you elaborate on the purpose for which you are hashing passwords? – David M May 17 '12 at 14:33
We store password hashes in order to authenticate users later when they log in :-) – lucho May 17 '12 at 18:06
lol, only if theyve already cracked it ;-) – Alex May 17 '12 at 22:57
up vote 7 down vote accepted

The recommendation is for PBKDF2 to be used as an algorithm for generating a cryptographic key from a password, not for hashing a password for safe storage for authentication purposes. (I trust you're salting as well?) So the answer is no, for your use case there is no such recommendation. This doesn't mean it's not suitable, but there isn't a NIST recommendation to cite.

share|improve this answer
"What's wrong with one of the SHA-2 functions?" Nothing, but bcrypt is better because it already has single-use salt and repetition built in / less room for error. Additionally, it is more resistant to specialized hardware (GPUs) because of the additional RAM requirement. – George Bailey May 17 '12 at 21:43
We are salting, of course - there is no PBKDF2 without salt. The wrong thing about SHA-2 is that they are very fast and general purpose. While bcrypt and PBKDF2 are designed to be slow. And their slowness is adjustable to follow the hardware advancements. Since many people use PBKDF2 for password hashing (including stackexhange!) we will maybe stick to it. Plus there is built in support in Java while there is no such for bcrypt. But you are right... there is no such a recommendation from NIST. What I would say now is that "NIST favors PBBKDF2" :D. – lucho May 18 '12 at 6:21
SHA-2 is obviously wrong for hashing a password for safe storage for authentication purposes. PBKDF2 is certainly much better in this scenario, but I'm not aware of an official NIST recommendation for this scenario. – CodesInChaos May 18 '12 at 13:42
@lucho, "slowness is adjustable to follow the hardware advancements" Actually you could also obtain adjustable slowness on SHA using repetition, though I would not recommend it (room for error, and yes, general purpose), it can be made to be nearly as effective. – George Bailey May 18 '12 at 14:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.