If I use PBDKF2 with a good enough password and salt to generate a 2n bytes key, does knowing the first or last n bytes make it any easier for a 3rd party to guess the other half of my key than using a brute force attack?

2 Answers 2


PBKDF2 is supposed to be secure as a key derivation function, which more or less means that knowing some of the output bytes leaves no usable information for guessing the other output bytes. If you produce 20 bytes with PBKDF2 but the attacker knows 12 of them, he still cannot guess the 8 remaining with better probability than pure luck (i.e. 2-64, since 8 bytes is 64 bits).

Note, though, that the "P" in PBKDF2 means "password", and the main weakness of anything involving passwords is that passwords are, in practice, guessable through dictionary attacks. While having a partial output does not yield immediate information on the other output bytes, it can serve as a fast test for a brutal enumeration of possible passwords.

A "normal" dictionary attack on PBKDF2 assumes a situation where the password was expanded into a symmetric encryption key, used to encrypt a piece of data. The attacker "tries" passwords, each time computing the corresponding key, then trying to decrypt the data, and see if the result "makes sense". If the attacker knows some of the bytes produced by PBKDF2, then he can skip the "decryption makes sense" step, which helps him a bit.


Of course it makes it easier. Your chance of randomly guessing a key of length 2n bytes is 1 / 2 ^ 16n. If you know the first or last n bytes, then your chance of guessing the rest is 1 / 2 ^ 8n, which is 2 ^ 8n times more likely.

  • That's true, after re-reading my question I guess I worded it wrong, sorry.
    – gzup
    Jul 24, 2015 at 13:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .