Key Derivation

Python has pretty limited support for key derivation built into the standard library. In fact, the only method that hashlib provides is the pbkdf2_hmac method, which is the PKCS#5 password-based key derivation function. It uses HMAC as its pseudorandom function. We might use something like this for hashing our password as it supports salt and iterations. For example, if we have to use SHA-256, we would need a salt of at least 16 bytes and a minimum of 100,000 iterations.

As a quick aside, a salt is just random data that we use as additional input into our hash to make it harder to “unhash” our password.

salt is basically a configuration management tool that protects our password from dictionary attacks and precomputed rainbow tables.

Simple example of key derivation

Let’s look at a simple example: