If I know the derived key DK1

DK1 = PBKDF2(sha512, password, random_salt, iterations = 1000, output length = 20)

it is possible to calculate the derived key DK2

DK2 = PBKDF2(sha512, password || SOME_TEXT, random_salt, iterations = 1000, output length = 20)

if I have full admin access (both to the hashing algorithm in the source code and to the salts in the DB) but I don't know the password? I know this would be possible if I would only use SHA1 to hash the password but what about pbkdf2? Why do I ask: I want to use DK1 for user authentication and DK2 in the DB for data anonymization (only the logged in user can perform joins between tables signed with user.id and tables signed with DK2). For that reason I have to make sure that no one can derive DK2 from DK1 otherwise the DB tables would not be properly anonymized and the DB admin could perform joins.

2 Answers 2


PBKDF2 does not (generally?) use two salts (salt and pepper). You need to understand that PBKDF2 is based on a PseudoRandom-Function (PRF) typically HMACSHA1.

It then proceed to compute the derivated key (what you call your hash I suppose) by iterating (gross simplification) :

Uc = PRF(Password, Uc-1)

where U0 = Salt || INT_32_BigEndian(i)

So in the standard PBKDF2 scheme, you can't guess the password by having the derivated key and the salt. However, if you had the derivated key, you don't need the user password as it is the derivated key which is relevant to any subsequent encryptions.

I am afraid you are mistaking PBKDF2 with another function.

You then get a derivated key which is to be used has a key to other encryption function. Are you sure it's PBKDF2, and what is the underlying PRF?

  • You are right, I rephrased the question. Sep 22, 2016 at 9:34

No. PBKDF2 uses HMAC which is specifically designed to withstand length extension attacks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .