# Is this implementation of PBKDF2 correct?

I am preparing for a presentation and I just want to double check that I've got it right:

PBKDF2 is:

for (0,4096)
{
data1 = HMACSHA1(data1, data2);
data2 = HMACSHA1(data2, data1);
}
where data1 and data2 are pass and respectively salt and
HMACSHA1 = SHA1(salt+SHA1(pass+salt))


Is this correct?

• 4096 iterations is only for the Kerberos standard, and WPA2. I removed your WPA2 tag as the question doesn't mention anything about it. If this is about WPA2, then the HMAC−SHA1 does make sense. – Yorick de Wid Sep 7 '16 at 7:26
• Yes, it is WPA2 related – Zodiac Sep 7 '16 at 7:31

Your loop is wrong in two aspects.

1. The length of the DK is also important

According to the wiki page (or you can go to the RFC if you'd like):

DK = PBKDF2(PRF, Password, Salt, c, dkLen)

where:

• PRF is a pseudorandom function of two parameters with output length hLen (e.g. a keyed HMAC)

...

Each hLen-bit block Ti of derived key DK, is computed as follows:

DK = T1 || T2 || ... || Tdklen/hlen

Ti = F(Password, Salt, c, i)

F(Password, Salt, c, i) = U1 ^ U2 ^ ... ^ Uc

where:

U1 = PRF(Password, Salt || INT_32_BE(i))

U2 = PRF(Password, U1)

...

Uc = PRF(Password, Uc-1)

WPA2 uses a 256 bits DK (DK = PBKDF2(HMAC−SHA1, passphrase, ssid, 4096, 256)), so the process needs two blocks (Ti) to reach this since SHA1 is only 160 bits long. Furthermore, the iteration described here uses the original password for each iteration i.e. Ui = PRF(Password, Ui-1), or you are reusing modified password on each iteration in your own loop.

For a simplified version for WPA2 I would write:

DK = B1 || trunc(B2)
B1 = F(Password, SSID || INT(1))
B2 = F(Password, SSID || INT(2))

where F(P, S) is the function

for(0, 4096) {
U = HMAC-SHA1(P, S)
S = U
}