Predict the attacker's work
One of 10,000 PINs enters HKDF with a public salt. Output length is 32 bytes.
How many candidate keys must an attacker consider?
1 / 5
One of 10,000 PINs enters HKDF with a public salt. Output length is 32 bytes.
How many candidate keys must an attacker consider?
At most 10,000 candidates for the fixed salt, if a correct guess can be recognized.
HKDF extracts uncertainty already present. Public salts and info labels do not invent secret uncertainty.
Password hashing prices each guess; it does not erase the candidate set.
PRK=HMAC(salt,IKM).
T1=HMAC(PRK,info||01). T2=HMAC(PRK,T1||info||02).
Output T1 plus ten bytes of T2. A one-byte counter permits at most 255 blocks: 8160 bytes.
For 40 bytes at c=3, compute two output blocks and six HMAC evaluations.
Each block XORs U1,U2,U3; it does not return only U3.
Its block counter is four big-endian bytes, while HKDF's is one byte.
Different public salts prevent sharing one derived verifier across accounts.
A pepper is secret and stored separately. Records retain algorithm, parameters, salt, and derived bytes.
Compare equal-length results without early exit. Upgrade after successful login; benchmark parameters under real concurrency.