Written by

Roche Diagnostics

Question Mathew Lambert · Jul 20, 2020

Is PBKDF2 with HMAC-SHA at 512 bits encryption, in line with NIST / FIPS recommendations?

We are using the mentioned password function and we need to know if is in line with the NIST recommendations regarding strength, https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf

Reading interystems docummentation is not 100% clear for me as it states "(See RSA Laboratories Public-Key Cryptography Standards #5 and Federal Information Processing Standards Publications 180-4 and 198-1 for more information.)"

Discussion (1)0

Add reply

Comments

Jon Willeke · Jul 20, 2020

FIPS 180-4 describes SHA-512 et al., FIPS 198-1 describes HMAC, and PKCS #5 describes PBKDF2, which depends on HMAC-SHA. As for NIST, special publication 800-132 (now ten years old) states: "This Recommendation approves PBKDF2 as the PBKDF using HMAC with any approved hash function as the PRF." For more recent guidance, consider special publication 800-63B.

As I understand it, none of the weaknesses in SHA affect HMAC or PBKDF2. However, if SHA-1 is no longer FIPS approved, the NIST guidance would indicate replacing it with, say, SHA-2 or SHA-3.

In terms of strength, PBKDF2 essentially has two parameters, the hash function, and the iteration count. For the hash function, bigger is usually slower, therefore stronger. For the iteration count, PKCS #5 and NIST 800-132 both suggest a minimum of 1,000. NIST 800-63B states: "the iteration count SHOULD be as large as verification server performance will allow, typically at least 10,000 iterations."

0 0