Editing PBKDF2 (section)

== Key derivation process ==
PBKDF2 has five input parameters:<ref name=rfc2898>Password-Based Cryptography Specification {{IETF RFC|2898}}</ref>

:{{math|1=DK = PBKDF2(PRF, {{var|Password}}, {{var|Salt}}, {{var|c}}, {{var|dkLen}})}}

where:
* {{math|PRF}} is a pseudorandom function of two parameters with output length {{var|hLen}} (e.g., a keyed HMAC)
* {{var|Password}} is the master password from which a derived key is generated
* {{var|Salt}} is a sequence of bits, known as a [[salt (cryptography)|cryptographic salt]]
* {{var|c}} is the number of iterations desired
* {{var|dkLen}} is the desired bit-length of the derived key
* {{var|DK}} is the generated derived key

Each {{var|hLen}}-bit block {{math|T{{sub|{{var|i}}}}}} of derived key {{var|DK}}, is computed as follows (with {{math|+}} marking string concatenation):

:{{math|1={{var|DK}} = T{{sub|1}} + T{{sub|2}} + ⋯ + T{{sub|{{var|dkLen}}/{{var|hLen}}}}}}
:{{math|1=T{{sub|i}} = F({{var|Password}}, {{var|Salt}}, {{var|c}}, {{var|i}})}}

The function {{math|F}} is the [[xor]] ({{math|^}}) of ''c'' iterations of chained PRFs. The first iteration of PRF uses ''Password'' as the PRF key and ''Salt'' concatenated with {{var|i}} encoded as a big-endian 32-bit integer as the input. (Note that ''i'' is a 1-based index.) Subsequent iterations of PRF use ''Password'' as the PRF key and the output of the previous PRF computation as the input:

:{{math|1=F({{var|Password}}, {{var|Salt}}, {{var|c}}, {{var|i}}) = U{{sub|1}} ^ U{{sub|2}} ^ ⋯ ^ U{{sub|{{var|c}}}}}}

where:
:{{math|1=U{{sub|1}} = PRF({{var|Password}}, {{var|Salt}} + INT_32_BE({{var|i}}))}}
:{{math|1=U{{sub|2}} = PRF({{var|Password}}, U{{sub|1}})}}
:{{math|⋮}}
:{{math|1=U{{sub|{{var|c}}}} = PRF({{var|Password}}, U{{sub|{{var|c}}-1}})}}

For example, [[WPA2]] uses:

:{{math|1=DK = PBKDF2({{text|HMAC-SHA1}}, {{var|passphrase}}, {{var|ssid}}, 4096, 256)}}

PBKDF1 had a simpler process: the initial ''U'' (called ''T'' in this version) is created by {{math|PRF({{var|Password}} + {{var|Salt}})}}, and the following ones are simply {{math|PRF({{var|U}}{{sub|previous}})}}. The key is extracted as the first ''dkLen'' bits of the final hash, which is why there is a size limit.<ref name=rfc2898/>