thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Intermediate

Password-Based Key Derivation Function 2 (PBKDF2)

Key derivation function that applies an HMAC many times with a salt to stretch a password.

Definition

PBKDF2 is defined in PKCS #5 v2 (RFC 8018) and is FIPS-friendly. Its security comes from the iteration count, but it is not memory-hard, so GPUs and ASICs can attack it efficiently. OWASP recommends 600,000 iterations for PBKDF2-HMAC-SHA256 as of its current guidance.

Example

WPA2-Personal derives the PMK using PBKDF2-HMAC-SHA1 with the SSID as salt and 4,096 iterations.

Exam tip

PBKDF2 is the key stretching choice when FIPS compliance is required.

Related terms