I'm trying to grasp which benefit can KDF like PBKDF2, scrypt and bcrypt (I know that bcrypt is technically not KDF) may bring over hashing in loop like sha256sum(sha256sum(sha256sum.....(salt + master password))) - N times, where N equals to some big number.

  • bcrypt is definitely a KDF, based on a block cipher but definitely a KDF and the first good one. PKKDF2 OTOH isn't a good KDF. The Introduction the Argon2 spec PDF explains a lot of what a good KDF needs : github.com/P-H-C/phc-winner-argon2/blob/master/argon2-specs.pdf Sep 20 at 16:05
  • See github.com/mitsuhiko/python-pbkdf2/blob/master/pbkdf2.py for a good example of a pbkdf2 function implemented in python. As you can see, it works the way you describe in your question, i.e. N iterations of a loop containing a cryptographic primitive.
    – mti2935
    Sep 20 at 19:23
  • @BrunoRohée according to wikipedia - en.wikipedia.org/wiki/Bcrypt - It is important to note that bcrypt is not a key derivation function (KDF). For example you cannot use bcrypt to derive a 512-bit key from a password. Sep 21 at 7:13
  • 1
    The issue is that I don't think there is a unanimously accepted definition of what a KDF is. bcrypt+key stretching definitely is a generic KDF in any case. Sep 21 at 12:14
  • 1
    Yes but a pretty bad one, as it is ASIC/FPGA friendly, GPU friendly, and have no memory hardness whatsoever. bcrypt is at least ASIC unfriendly. Sep 21 at 15:27


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.