MAC, KDF & password hashingAcceptable
Password-Based Key Derivation Function 2
Password-based key derivation and password hashing
How it works
PBKDF2 runs a pseudorandom function, usually HMAC-SHA256, many thousands of times over the password and a salt. The iteration count makes each guess expensive. It is used in WPA2-Personal to derive the key from the passphrase and in many disk encryption and password storage systems.
Sizes: Configurable iteration count, salt and output length
Status: FIPS-approved, but not memory-hard; prefer Argon2id where FIPS is not required.
Strengths
- FIPS-approved (NIST SP 800-132), so it is the usual choice when FIPS compliance is mandatory
- Simple and universally available
Weaknesses and known attacks
- Uses little memory, so attackers can run guesses massively in parallel on GPUs and ASICs.
- Low iteration counts give little protection; counts need to rise as hardware improves.
Use it for
- Password storage in FIPS environments with a high iteration count
- Deriving encryption keys from passphrases
Don't use it for
- New non-FIPS password storage where Argon2id or scrypt is available
- Low iteration counts
Exam tip
PBKDF2 and bcrypt are classic key stretching algorithms. Key stretching makes each password guess slower; salting stops precomputed rainbow tables.