### Exploiting an HMAC-SHA-1 optimization to speed up PBKDF2

Andrea Visconti and Federico Gorla

##### Abstract

PBKDF2 [27] is a well-known password-based key derivation function. In order to slow attackers down, PBKDF2 introduces CPU-intensive operations based on an iterated pseudorandom function (in our case HMAC-SHA-1). If we are able to speed up a SHA-1 or an HMAC implementation, we are able to speed up PBKDF2-HMAC-SHA-1. This means that a performance improvement might be exploited by regular users and attackers. Interestingly, FIPS 198-1 [31] suggests that it is possible to precompute first message block of a keyed hash function only once, store such a value and use it each time is needed [43]. Therefore the computation of first message block does not contribute to slowing attackers down, thus making the computation of second message block crucial. In this paper we focus on the latter, investigating the possibility to avoid part of the HMAC-SHA-1 operations. We show that some CPU-intensive operations may be replaced with a set of equivalent, but less onerous, instructions. We identify useless XOR operations exploiting and extending Intel optimizations [26], and applying the Boyar-Peralta heuristic [12]. In addition, we provide an alternative method to compute the SHA-1 message scheduling function and explain why attackers might exploit these findings to speed up a brute force attack.

Available format(s)
Publication info
Preprint. MINOR revision.
Keywords
HMAC-SHA-1Password-Based Key Derivation Function 2PKCS#5Intel optimizationsBoyar-Peralta heuristic
Contact author(s)
andrea visconti @ unimi it
History
Short URL
https://ia.cr/2018/097

CC BY

BibTeX

@misc{cryptoeprint:2018/097,
author = {Andrea Visconti and Federico Gorla},
title = {Exploiting an HMAC-SHA-1 optimization to speed up PBKDF2},
howpublished = {Cryptology ePrint Archive, Paper 2018/097},
year = {2018},
note = {\url{https://eprint.iacr.org/2018/097}},
url = {https://eprint.iacr.org/2018/097}
}

Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.