Paper 2018/097

Exploiting an HMAC-SHA-1 optimization to speed up PBKDF2

Andrea Visconti and Federico Gorla


PBKDF2 [27] is a well-known password-based key derivation function. In order to slow attackers down, PBKDF2 introduces CPU-intensive operations based on an iterated pseudorandom function (in our case HMAC-SHA-1). If we are able to speed up a SHA-1 or an HMAC implementation, we are able to speed up PBKDF2-HMAC-SHA-1. This means that a performance improvement might be exploited by regular users and attackers. Interestingly, FIPS 198-1 [31] suggests that it is possible to precompute first message block of a keyed hash function only once, store such a value and use it each time is needed [43]. Therefore the computation of first message block does not contribute to slowing attackers down, thus making the computation of second message block crucial. In this paper we focus on the latter, investigating the possibility to avoid part of the HMAC-SHA-1 operations. We show that some CPU-intensive operations may be replaced with a set of equivalent, but less onerous, instructions. We identify useless XOR operations exploiting and extending Intel optimizations [26], and applying the Boyar-Peralta heuristic [12]. In addition, we provide an alternative method to compute the SHA-1 message scheduling function and explain why attackers might exploit these findings to speed up a brute force attack.

Available format(s)
Publication info
Preprint. MINOR revision.
HMAC-SHA-1Password-Based Key Derivation Function 2PKCS#5Intel optimizationsBoyar-Peralta heuristic
Contact author(s)
andrea visconti @ unimi it
2018-01-28: received
Short URL
Creative Commons Attribution


      author = {Andrea Visconti and Federico Gorla},
      title = {Exploiting an {HMAC}-{SHA}-1 optimization to speed up {PBKDF2}},
      howpublished = {Cryptology ePrint Archive, Paper 2018/097},
      year = {2018},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.