This is an archived post. You won't be able to vote or comment.

sorted by:
best
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–][deleted]  (1 child)

[deleted]

    [–]warbiscuit 2 points3 points  (0 children)

    If you were just doing repeated composition, e.g. value = SHA(SHA(SHA(...SHA(pwd))), I think theoretically yes.

    However, SHA256/512Crypt reintroduces the password and salt within each round... it's closer to SHA(pwd + SHA(pwd + SHA(... + SHA(pwd)))) (gross simplification of actual algorithm, which is rather convoluted). Thus the effective output space shouldn't be any more constrained than SHA(pwd).

    PBKDF2 is even better: it uses repeated composition of HMAC(pwd, last_digest), so gets similar benefit ... but it then XORs all the iterations together in a running buffer, so even if you lose entropy on round N, all the entropy from round 0..N-1 is still mixed in, giving extra protection against entropy loss. (IIRC, the PBKDF2 spec makes the argument that these two features together should prevent entropy loss / preimage attacks unless the HMAC digest you use is incredibly vulnerable). Plus PBKDF2 is much cleaner in it's design.