Can I calculate the derived key generated by pbkdf2(password || SOME_TEXT) if I know pbkdf2(password)?

Question

If I know the derived key DK1

DK1 = PBKDF2(sha512, password, random_salt, iterations = 1000, output length = 20)

it is possible to calculate the derived key DK2

DK2 = PBKDF2(sha512, password || SOME_TEXT, random_salt, iterations = 1000, output length = 20)

if I have full admin access (both to the hashing algorithm in the source code and to the salts in the DB) but I don't know the password? I know this would be possible if I would only use SHA1 to hash the password but what about pbkdf2? Why do I ask: I want to use DK1 for user authentication and DK2 in the DB for data anonymization (only the logged in user can perform joins between tables signed with user.id and tables signed with DK2). For that reason I have to make sure that no one can derive DK2 from DK1 otherwise the DB tables would not be properly anonymized and the DB admin could perform joins.

Answer 1

PBKDF2 does not (generally?) use two salts (salt and pepper). You need to understand that PBKDF2 is based on a PseudoRandom-Function (PRF) typically HMACSHA1.

It then proceed to compute the derivated key (what you call your hash I suppose) by iterating (gross simplification) :

Uc = PRF(Password, Uc-1)

where U0 = Salt || INT_32_BigEndian(i)

So in the standard PBKDF2 scheme, you can't guess the password by having the derivated key and the salt. However, if you had the derivated key, you don't need the user password as it is the derivated key which is relevant to any subsequent encryptions.

I am afraid you are mistaking PBKDF2 with another function.

You then get a derivated key which is to be used has a key to other encryption function. Are you sure it's PBKDF2, and what is the underlying PRF?

Answer 2

No. PBKDF2 uses HMAC which is specifically designed to withstand length extension attacks.