PBKDF2
also: PBKDF2-HMAC-SHA256, Password-Based Key Derivation Function 2
PBKDF2 (Password-Based Key Derivation Function 2) is a cryptographic algorithm that derives a secure encryption key from a password by applying a hash function repeatedly many times, making brute-force attacks computationally expensive.
PBKDF2 strengthens weak passwords by iterating a hash function thousands or millions of times, deliberately slowing down the key derivation process. This makes it impractical for attackers to guess passwords through brute force since each attempt requires significant computation.
The function takes four inputs: a password, a salt (random data), an iteration count, and a desired output length. The salt ensures that identical passwords produce different keys, preventing rainbow table attacks.
PBKDF2 is commonly used in Linux systems for password hashing in applications like encrypted filesystems and VPN protocols. For example, LUKS (Linux Unified Key Setup) uses PBKDF2 to derive encryption keys from user passphrases: cryptsetup luksFormat /dev/sda1 internally applies PBKDF2 to secure the disk.
While still widely deployed, PBKDF2 is considered less resistant to GPU/ASIC attacks than newer alternatives like Argon2, which are increasingly recommended for new systems.