Answers / What is password-based key derivation?

What is password-based key derivation?

Why not use the password as the key?

A password is a short, memorable string with far less entropy than a modern key. Using it directly, or hashing it once, gives an attacker a cheap test for each guess. A derivation function makes every guess cost memory, time or both, so a dictionary attack becomes an expensive search rather than a fast lookup.

What does the salt do?

The salt is a value mixed into the derivation so that the same password does not produce the same key twice. It makes precomputed tables useless and stops one successful guess from unlocking every copy of the password. It does not need to be secret, but it must be unique and it must be stored so the key can be re-derived.

What do the cost parameters buy?

They set the price of a guess. Argon2i uses memory, iterations and parallelism; PBKDF2 uses an iteration count and a pseudorandom function. The right numbers depend on the weakest hardware that must run the derivation and on the delay users will tolerate. A parameter set copied from another organisation is not a decision.

Where does the published record stop?

The public preview shows the contents and clauses 1 to 3. It names Argon2i and PBKDF2 in the introduction but does not publish the normative clauses, the identifiers or the parameter guidance. This site states that limit instead of filling it with recalled text.

The short answer, with its limit

The draft specifies two functions: Argon2i, which is memory-hard with a data-independent access pattern, and PBKDF2, which is iteration-hard and widely available in validated modules. Both take a password, a salt and cost parameters, and both return a key for another algorithm.

Where the public record is silent, this page says so and does not fill the gap. The register carries the clause-level detail.