Table of Contents

Class Pbkdf2

Namespace
CryptoHives.Foundation.Security.Cryptography.Kdf
Assembly
CryptoHives.Foundation.Security.Cryptography.dll

Implements PBKDF2 (Password-Based Key Derivation Function 2) as defined in RFC 8018 §5.2 (formerly RFC 2898).

public static class Pbkdf2
Inheritance
Pbkdf2
Inherited Members

Examples

// Derive a 32-byte key from a password using HMAC-SHA-256 with 600,000 iterations
byte[] password = Encoding.UTF8.GetBytes("my-password");
byte[] salt = RandomNumberGenerator.GetBytes(16);

byte[] derivedKey = Pbkdf2.DeriveKey(
    key => new HmacSha256(key),
    password, salt, iterations: 600_000, outputLength: 32);

Remarks

PBKDF2 derives keying material from a password by applying a pseudorandom function (PRF) — typically HMAC — iteratively. The iteration count slows down brute-force attacks, making it suitable for password hashing and password-based encryption.

This implementation uses the CryptoHives IMac interface via the HmacFactory delegate, making it pluggable with any HMAC variant (SHA-256, SHA-384, SHA-512, SHA-1, etc.) and fully managed across all platforms.

Unlike the .NET Rfc2898DeriveBytes class, this implementation:

  • Supports any PRF via HmacFactory (not limited to HashAlgorithmName).
  • Provides span-based overloads for zero-copy key derivation.
  • Works on all target frameworks including .NET Framework 4.6.2 and .NET Standard 2.0.

PBKDF2 is used in WPA/WPA2 key derivation, PKCS#12, S/MIME, password storage, and many enterprise authentication protocols.

Methods

DeriveKey(HmacFactory, byte[], byte[], int, int)

Derives keying material from a password using PBKDF2.

public static byte[] DeriveKey(HmacFactory hmacFactory, byte[] password, byte[] salt, int iterations, int outputLength)

Parameters

hmacFactory HmacFactory

A factory that creates an IMac instance keyed with the given key.

password byte[]

The password (input keying material).

salt byte[]

The cryptographic salt.

iterations int

The iteration count (c). Higher values increase resistance to brute-force attacks.

outputLength int

The desired length of the derived keying material in bytes.

Returns

byte[]

The derived keying material.

Exceptions

ArgumentNullException

hmacFactory, password, or salt is null.

ArgumentOutOfRangeException

outputLength is less than 1 or iterations is less than 1.

DeriveKey(HmacFactory, ReadOnlySpan<byte>, ReadOnlySpan<byte>, int, Span<byte>)

Derives keying material from a password using PBKDF2.

public static void DeriveKey(HmacFactory hmacFactory, ReadOnlySpan<byte> password, ReadOnlySpan<byte> salt, int iterations, Span<byte> output)

Parameters

hmacFactory HmacFactory

A factory that creates an IMac instance keyed with the given key. The password is used as the HMAC key.

password ReadOnlySpan<byte>

The password (input keying material).

salt ReadOnlySpan<byte>

The cryptographic salt.

iterations int

The iteration count (c). Higher values increase resistance to brute-force attacks. OWASP recommends at least 600,000 for HMAC-SHA-256.

output Span<byte>

The destination buffer to receive the derived keying material.

Exceptions

ArgumentNullException

hmacFactory is null.

ArgumentException

output is empty.

ArgumentOutOfRangeException

iterations is less than 1.

Edit this page