At The Core of Cybersecurity Is “The Secret”: And The Great Protector is PBKDF2

At The Core of Cybersecurity Is “The Secret”: And The Great Protector is PBKDF2

At the core of cybersecurity is the secret. What does that mean? Well, somewhere on your system, there are core secrets that protect you from Eve and Mallory. If they discover these secrets, your environment will likely be compromised in some way. These are likely to relate to your password, your secret PIN or the encryption keys that you use. While we might generate completely random encryption keys, eventually we will have to protect them with a secret password.

In the past, we used to basically hashed our passwords by using cryptographically (and fast) hashing methods, such as MD4 (as used in Windows), MD5 and SHA1. But their speed has a downside, and where Eve can try many passwords from a dictionary and discover the mapping of the password to the hashed version. This allows Eve to build a rainbow table of all the most popular passwords. To overcome this, we can add salt to the hashing process, and which defeats the rainbow table building, but not for a dictionary attack. Unfortunately the salt value must be well-known, and so Eve can basically take a dictionary of common words, and just add a salt value, and compute the hash. If the password is common, or has an easy-to-guess pattern (such as an uppercase first letter, or a number at the end).

So, what’s the solution? Well, the magic to use a KDF (Key Derivation Function), and where we slow down the whole process. This is done by continually hashing over a number of rounds. So, as long as we know how many rounds were used to hash the password, we should be able to recreate when checking it.

In fact, we even get to a point that we can only hash just a few passwords per second, and not billions. Thus, if we select our hashing method properly, we can make it extremely difficult for someone to discover the original password. This is the same for the generation of encryption keys from passwords.

PBKDF2

The method that has risen to the top in terms of protecting our secrets is PBKDF2 (Password-Based Key Derivation Function 2). It is defined in RFC 2898 and generates a salted hash. We also add a number of iterations, and which slows down the hashing process. The most recent standard is RFC 8018 [here]:

Often this is used to create an encryption key from a defined password, and where it is not possible to reverse the password from the hashed value. PBKDF2 is used in TrueCrypt to generate the key required to read the header information of the encrypted drive and which stores the encryption keys. In WPA-2 we use 4,096 iterations.

Within PowerShell, we have the Security.Cryptography.Rfc2898DeriveBytes class, and then have we can use a the Pbkdf2() method:

$keyder=
 [Security.Cryptography.Rfc2898DeriveBytes]::
   Pbkdf2($password,$saltBytes,$iterations,$hash,$size)

and which requires a password, a salt value (as bytes), the number of iterations, the hash type (MD5, SHA-1 or SHA-256), and the number of bytes used for the output. For a 128-bit key to be derived, we require 16 bytes, but for a 256-bit key we need 32 bytes. It should be noted that MD5 is not considered as being a secure hashing method, and SHA-1 is on the boundary of being insecure. Normally we would use a SHA-2 method, such as SHA-256 or SHA-512.

The following is the coding using PowerShell [here]:

$password = $Args[0]
$salt = $Args[1]
$iterations = [int]$Args[2]
$hash = $Args[3]
$size=$Args[4]
$saltBytes = [Text.Encoding]::UTF8.GetBytes($salt)
$keyder=[Security.Cryptography.Rfc2898DeriveBytes]::Pbkdf2($password,$saltBytes,$iterations,$hash,$size)"Password: "+$password
"Salt: "+$salt
"Iterations: "+$iterations
"Hash method: "+$hash
"Size: "+$size
"`nKey derivation (Hex): "+[System.Convert]::ToHexString($keyder)
"Key derivation (Hex): "+[System.Convert]::ToBase64String($keyder)

A sample run in SHA-384, a hash length of 32 bytes and 1,000 rounds for a password of “qwerty” is [here]:

Password: qwerty
Salt: test123
Iterations: 1500
Hash method: SHA384
Size: 32
Key derivation (Hex): 7A1DE374983CB727A2E37AB8324FA5FA2FA6A90DE30841F16919159119E4F292
Key derivation (Hex): eh3jdJg8tyei43q4Mk+l+i+mqQ3jCEHxaRkVkRnk8pI=

A sample run is here:

https://asecuritysite.com/powershell/ps_pbkdf2

Conclusions

Don’t hash a password to an encryption key using our standard hashing methods, as there are security issues and the hashing is fast. An improved method is to use PBKDF2, and which slows down the whole of the hashing process. And, did you know that the core of the security of your connection to Wifi access points is based on PBKDF2?