Key Derivation Functions: PBKDF2, bcrypt, and Argon2

Storing passwords requires a special class of cryptographic function called a password hashing function (PHF) or key derivation function (KDF). Regular cryptographic hashes like SHA-256 are designed to be fast — a modern GPU can compute billions of SHA-256 hashes per second. This speed is catastrophic for password storage: an attacker who steals a hash database can try billions of guesses per second. Password KDFs are intentionally slow, tunable to make brute-force attacks computationally infeasible while still allowing legitimate login within milliseconds.

Before dedicated password KDFs existed, attackers used rainbow tables — precomputed mappings from hash values back to plaintext passwords. A salt is a random value unique per user that is prepended or appended to the password before hashing, making every hash unique even for identical passwords. Salts are stored alongside the hash in the database — they are not secret, just random. A proper salt must be: at least 16 bytes, generated by a cryptographically secure random number generator, and stored per-user (never reused across accounts).

PBKDF2 (Password-Based Key Derivation Function 2) is defined in RFC 8018 and is approved by NIST. It works by repeatedly applying an HMAC function (typically HMAC-SHA-256) to the password and salt, for a configurable number of iterations. The iteration count is the work factor — NIST recommends at least 600,000 iterations of PBKDF2-HMAC-SHA256 as of 2023. PBKDF2 is widely used (Django, iOS Keychain, WPA2-PSK) but has one weakness: it can be implemented efficiently on GPUs, making it less GPU-resistant than alternatives.

bcrypt was designed by Niels Provos and David Mazieres in 1999 and remains widely used. Its key innovation is a cost factor (rounds parameter), where each increment doubles the computation time. Bcrypt uses a modified Blowfish cipher with an Eksblowfish key setup that is both CPU and memory intensive, making it significantly harder to accelerate on GPUs compared to PBKDF2. Bcrypt also limits password input to 72 bytes (longer passwords are truncated), which requires hashing long passwords first with SHA-256 in some implementations.

Argon2 won the Password Hashing Competition in 2015 and is the current OWASP recommendation. It comes in three variants: Argon2d (faster, vulnerable to side-channel, best for cryptocurrency), Argon2i (constant-time, best for password hashing), and Argon2id (hybrid, recommended for most uses). Argon2id is configurable along three dimensions: time cost (iterations), memory cost (RAM required), and parallelism (threads). High memory requirements make it extremely difficult to parallelize on GPUs and completely infeasible on ASICs.

GPUs have thousands of cores but limited memory per core — they excel at parallelizing simple, memory-light computations. Memory-hard functions like Argon2 and scrypt require large amounts of RAM for each hash computation. If an attacker wants to run 10,000 parallel Argon2id computations each requiring 64MB of memory, they need 640GB of GPU RAM — far exceeding what any GPU cluster has available. This property, called memory hardness, forces attackers to either use slow, sequential computations or invest in extraordinary hardware costs that make attacks uneconomical.

The right work factor depends on your hardware and acceptable latency. The general target is 100-300ms on the server's production hardware for each authentication. As hardware improves, you should increase the work factor — this is why bcrypt and Argon2 store the parameters alongside the hash, allowing transparent upgrades: on next login, verify the password, then re-hash with the new higher parameters. OWASP maintains current recommended minimum parameters for PBKDF2, bcrypt, and Argon2id that should be reviewed annually.

scrypt, designed by Colin Percival in 2009, was the first widely adopted memory-hard KDF and is used by Litecoin and many password managers. scrypt is parameterized by N (CPU/memory cost), r (block size), and p (parallelization factor). Like Argon2, high N values require large amounts of RAM per computation. scrypt is considered secure but Argon2id is generally preferred for new applications because it won the PHC and has received more cryptographic analysis. Both are acceptable choices.

Several hashing approaches must never be used for passwords: MD5 (broken, billions of hashes/second on consumer hardware), SHA-1 (same problem), unsalted SHA-256 (fast, rainbow tables trivial), and simple encryption (reversible, key theft equals all passwords). Historical breaches like LinkedIn (2012) used unsalted SHA-1, exposing 117 million passwords that were cracked within days. Adobe (2013) encrypted (not hashed) passwords — a fundamental misunderstanding that exposed 153 million accounts. These incidents are in the Security+ exam body of knowledge.

KDFs are also used to derive encryption keys from passwords (as opposed to storing password hashes). When a user sets a master password for an encrypted vault, the application uses a KDF to derive the actual AES-256 encryption key from that password. This is why password managers can decrypt your vault locally — they run the KDF on your master password to reconstruct the encryption key, which never leaves your device. HKDF (HMAC-based Key Derivation Function) is the standard for deriving multiple keys from a single high-entropy secret, used in TLS 1.3 to derive handshake and application keys.

Credential stuffing attacks replay username/password pairs stolen from one breach against other services. Strong KDFs reduce the window for offline cracking after a breach — if the attacker must spend 300ms per guess instead of microseconds, cracking a 10-character random password becomes computationally infeasible. However, KDFs do not protect against password reuse across sites — that requires users to use unique passwords. The combination of unique passwords + Argon2id storage + MFA makes credential-based attacks practically ineffective.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: password KDFs are intentionally slow with tunable work factors to make offline brute-force attacks computationally infeasible, memory-hard functions like Argon2id and scrypt defeat GPU parallelization by requiring large RAM per computation, and MD5, SHA-1, and unsalted hashes are completely inadequate for password storage as demonstrated by multiple high-profile breaches. Next up we explore post-quantum cryptography and the algorithms selected by NIST to replace RSA and ECC.