CODEWITHSUNDEEP
pythonpython-3.xsalt-cryptographypbkdf2hashlib
Dr.H
Dr.H

Reputation: 23

Iteration in password-based Key derivation function 2

so I am currently learning Python and am learning about encryption methods in that language. There I found the function pbkdf2_hmac(hash_name, password, salt, iterations, dklen=None) from the hashlib library.

However, the parameter "iterations" does not work as I expect it to. As the following simple code shows, when i try to call the function twice with one iteration, I get a different answer then when I call it once with two iterations. Since hashing functions are deterministic, both methods should yield the same result.

import hashlib
a=hashlib.pbkdf2_hmac("sha256",b"hallo",b"salt",1)
b=hashlib.pbkdf2_hmac("sha256",a,b"salt",1)
c=hashlib.pbkdf2_hmac("sha256",b"hallo",b"salt",2)
print(b)
print(c)

Can someone tell me what went wrong?

Upvotes: 2

Views: 839

Answers (1)

bartonjs
bartonjs

Reputation: 33256

The 2nd iterations of PBKDF2 isn't just PBKDF2(the first iteration).

A simplified explanation is:

  • 1 iteration: HMAC(password, salt || 00000001)
  • 2 iterations: HMAC(password, HMAC(password, salt || 00000001))
  • PBKDF2(PBKDF2): HMAC(HMAC(password, salt || 00000001), salt || 00000001)

Note that the "2 iterations" and "PBKDF2(PBKDF2)" versions use different HMAC keys for the second computation, which is why they give different results.

As far as "hashing functions are deterministic": They are. If you call them with the same inputs they give the same outputs. You gave them different inputs, due to misunderstanding how the underlying algorithm works.

Upvotes: 1

Related Questions