PBKDF2
Password-Based Key Derivation Function 2
It applies a pseudorandom function, usually HMAC-SHA-256, many times to a password and salt. It is not memory-hard, so it needs a high iteration count, 600,000 for PBKDF2-HMAC-SHA256 in OWASP’s guidance; use it where FIPS 140 validation is required.
- Defined in
- RFC 8018
Covered in
Password storage: hashing parameters and rehash on login
Choose Argon2id, scrypt, PBKDF2 or bcrypt with current minimum parameters, store a versioned hash, and upgrade old hashes after a successful login without overwriting a reset.
Case study: the LastPass breach (2022)
How an attacker went from a compromised developer laptop to a DevOps engineer's home computer, the keys to LastPass's cloud backups and a copy of customer vaults; why each vault's safety then rested on its master password and PBKDF2 iteration count; and what it teaches about backup keys, privileged endpoints, KDF upgrades and unencrypted metadata.
Practice: Password hashing lab: Verify and upgrade an Argon2 password hash on login