PBKDF简介基于口令的密钥派生函数也称为基于口令的密钥导出函数Password-Based Key Derivation FunctionPBKDF是利用口令派生密钥的一种算法通过加盐、迭代哈希将低强度口令转换为高安全密钥抵御暴力破解与字典攻击广泛用于密码存储、加密密钥生成等身份认证与数据安全场景。关于PBKDF的更加详细的介绍可以参见如下几个文档。GMT0091基于口令的密钥派生的研究笔记PKCS#5研究——基于口令的密码技术合图表——基于口令的密钥派生标准对比分析PKCS#5 v2.1和RFC8018标准给出了PBKDF1和PBKDF2两种方案其中的PBKDF1是为了兼容早期的版本安全性相对弱些所以一般使用PBKDF2方案包括NIST SP800-132和GM/T 00911—2020《基于口令的密钥派生规范》都是使用PBKDF2方案。本文主要列出PBKDF2的测试向量。测试数据来源https://www.rfc-editor.org/rfc/rfc6070https://github.com/brycx/Test-Vector-Generation/blob/master/PBKDF2/pbkdf2-hmac-sha2-test-vectors.mdhttps://github.com/openssl/openssl/blob/master/test/recipes/30-test_evp_data/evpkdf_pbkdf2.txt注1: PKCS#5 v2.1 和 RFC8018 给出了 PBKDF1 和 PBKDF2 两种方案, 其中的 PBKDF1 是为了兼容早期的版本安全性相对弱些, 所以一般使用 PBKDF2 方案, 包括NIST SP800-132 和 GM/T 00911-2020《基于口令的密钥派生规范》都是使用 PBKDF2 方案.注2: PBKDF2-HMAC-SHA 系列的测试数据来自以上网址, 并经测试核对通过.注3: 公开资料中暂未找到 PBKDF2-HMAC-SM3 (即GM/T 00911-2020) 的测试数据, 所以这是自行生成数据, 待核对. 邀请各位共同核对. 若有核对不一致之处, 敬请留言讨论交流, 谢谢.Test Case 1Input:P password (8 octets)S salt (4 octets)c 1dkLen 20~64Output:PBKDF2-HMAC-SHA1 0c60c80f961f0e71f3a9b524af6012062fe037a6 (20 octets)PBKDF2-HMAC-SHA224 3c198cbdb9464b7857966bd05b7bc92bc1cc4e6e (20 octets)PBKDF2-HMAC-SHA256 120fb6cffcf8b32c43e7225256c4f837a86548c9 (20 octets)PBKDF2-HMAC-SHA384 c0e14f06e49e32d73f9f52ddf1d0c5c719160923 (20 octets)PBKDF2-HMAC-SHA512 867f70cf1ade02cff3752599a3a53dc4af34c7a6 (20 octets)PBKDF2-HMAC-SHA512 867f70cf1ade02cff3752599a3a53dc4af34c7a669815ae5d513554e1c8cf252c02d470a285a0501bad999bfe943c08f050235d7d68b1da55e63f73b60a57fce (64 octets)PBKDF2-HMAC-SM3 4612f922a1fdcefaf4312fc6f8f3322b489cbf24 (20 octets)Test Case 2Input:P password (8 octets)S salt (4 octets)c 2dkLen 20~64Output:PBKDF2-HMAC-SHA1 ea6c014dc72d6f8ccd1ed92ace1d41f0d8de8957 (20 octets)PBKDF2-HMAC-SHA224 93200ffa96c5776d38fa10abdf8f5bfc0054b971 (20 octets)PBKDF2-HMAC-SHA256 ae4d0c95af6b46d32d0adff928f06dd02a303f8e (20 octets)PBKDF2-HMAC-SHA384 54f775c6d790f21930459162fc535dbf04a93918 (20 octets)PBKDF2-HMAC-SHA512 e1d9c16aa681708a45f5c7c4e215ceb66e011a2e (20 octets)PBKDF2-HMAC-SHA512 e1d9c16aa681708a45f5c7c4e215ceb66e011a2e9f0040713f18aefdb866d53cf76cab2868a39b9f7840edce4fef5a82be67335c77a6068e04112754f27ccf4e (64 octets)PBKDF2-HMAC-SM3 fee723a2bc966e11dffb66133f4e8df577383c78 (20 octets)Test Case 3Input:P password (8 octets)S salt (4 octets)c 4096dkLen 20~64Output:PBKDF2-HMAC-SHA1 4b007901b765489abead49d926f721d065a429c1 (20 octets)PBKDF2-HMAC-SHA224 218c453bf90635bd0a21a75d172703ff6108ef60 (20 octets)PBKDF2-HMAC-SHA256 c5e478d59288c841aa530db6845c4c8d962893a0 (20 octets)PBKDF2-HMAC-SHA384 559726be38db125bc85ed7895f6e3cf574c7a01c (20 octets)PBKDF2-HMAC-SHA512 d197b1b33db0143e018b12f3d1d1479e6cdebdcc (20 octets)PBKDF2-HMAC-SHA512 d197b1b33db0143e018b12f3d1d1479e6cdebdcc97c5c0f87f6902e072f457b5143f30602641b3d55cd335988cb36b84376060ecd532e039b742a239434af2d5 (64 octets)PBKDF2-HMAC-SHA3-224 691292bc3683d7d41ea2910f5b3eed23 (16 octets)PBKDF2-HMAC-SHA3-256 778b6e237a0f49621549ff70d218d208 (16 octets)PBKDF2-HMAC-SHA3-384 9a5f1e45e8b83f1b259ba72d11c59087 (16 octets)PBKDF2-HMAC-SHA3-512 2bfaf2d5ceb6d10f5e262cd902488cfd (16 octets)PBKDF2-HMAC-SM3 b6e8f2074c87432b78f62e5ced980fdff89e86af (20 octets)Test Case 4Input:P password (8 octets)S salt (4 octets)c 16777216dkLen 20Output:PBKDF2-HMAC-SHA1 eefe3d61cd4da4e4e9945b3d6ba2158c2634e984 (20 octets)PBKDF2-HMAC-SHA224 b49925184cb4b559f365e94fcafcd4cdb9f7aef4 (20 octets)PBKDF2-HMAC-SHA256 cf81c66fe8cfc04d1f31ecb65dab4089f7f179e8 (20 octets)PBKDF2-HMAC-SHA384 a7fdb349ba2bfa6bf647bb0161bae1320df27e64 (20 octets)PBKDF2-HMAC-SHA512 6180a3ceabab45cc3964112c811e0131bca93a35 (20 octets)PBKDF2-HMAC-SM3 a8bd50aaf36981bd269ac7e8856838088a3d0ec4 (20 octets)Test Case 5Input:P passwordPASSWORDpassword (24 octets)S saltSALTsaltSALTsaltSALTsaltSALTsalt (36 octets)c 4096dkLen 25~64Output:PBKDF2-HMAC-SHA1 3d2eec4fe41c849b80c8d83662c0e44a8b291a964cf2f07038 (25 octets)PBKDF2-HMAC-SHA224 056c4ba438ded91fc14e0594e6f52b87e1f3690c0dc0fbc057 (25 octets)PBKDF2-HMAC-SHA256 348c89dbcbd32b2f32d814b8116e84cf2b17347ebc1800181c (25 octets)PBKDF2-HMAC-SHA256 348c89dbcbd32b2f32d814b8116e84cf2b17347ebc1800181c4e2a1fb8dd53e1c635518c7dac47e9 (40 octets)PBKDF2-HMAC-SHA384 819143ad66df9a552559b9e131c52ae6c5c1b0eed18f4d283b (25 octets)PBKDF2-HMAC-SHA512 8c0511f4c6e597c6ac6315d8f0362e225f3c501495ba23b868 (25 octets)PBKDF2-HMAC-SHA512 8c0511f4c6e597c6ac6315d8f0362e225f3c501495ba23b868c005174dc4ee71115b59f9e60cd9532fa33e0f75aefe30225c583a186cd82bd4daea9724a3d3b8 (64 octets)PBKDF2-HMAC-SM3 3b6282ac8519f059e465abff0ea37b0dbfe6c672a76e6b8053 (25 octets)Test Case 6Input:P pass\0word (9 octets)S sa\0lt (5 octets)c 4096dkLen 16Output:PBKDF2-HMAC-SHA1 56fa6aa75548099dcc37d7f03425e0c3 (16 octets)PBKDF2-HMAC-SHA224 9b4011b641f40a2a500a31d4a392d15c (16 octets)PBKDF2-HMAC-SHA256 89b69d0516f829893c696226650a8687 (16 octets)PBKDF2-HMAC-SHA384 a3f00ac8657e095f8e0823d232fc60b3 (16 octets)PBKDF2-HMAC-SHA512 9d9e9c4cd21fe4be24d5b8244c759665 (16 octets)PBKDF2-HMAC-SM3 5f936b2e356f06e2bb3932165821261c (16 octets)Test Case 7Input:P passwd (6 octets)S salt (4 octets)c 1dkLen 128Output:PBKDF2-HMAC-SHA224 e55bd77cfc18b012ac6362e22d7cdf77c4b03879a6af51fbf0045bc32a03e7f0d829d26b765bff0ca5873e07a8e85804ff4a17683ed706130d51657456bc0ebd07c35ca0675b3113ad9c33fe48a5eb9e9dc6c6a8cf5cf6de1318b414dbe667bfaeb863ef8399ff4a732520dab4ba82336513a25077ddfc11fc618c11efaf04ae (128 octets)PBKDF2-HMAC-SHA256 55ac046e56e3089fec1691c22544b605f94185216dde0465e68b9d57c20dacbc49ca9cccf179b645991664b39d77ef317c71b845b1e30bd509112041d3a19783c294e850150390e1160c34d62e9665d659ae49d314510fc98274cc79681968104b8f89237e69b2d549111868658be62f59bd715cac44a1147ed5317c9bae6b2a (128 octets)PBKDF2-HMAC-SHA384 cd3443723a41cf1460cca9efeede428a8898a82d2ad4d1fc5cca08ed3f4d3cb47a62a70b3cb9ce65dcbfb9fb9d425027a8be69b53e2a22674b0939e5e0a682f76d21f449ad184562a3bc4c519b4d048de6d8e0999fb88770f95e40185e19fc8b68767417ccc064f47a455d045b3bafda7e81b97ad0e4c5581af1aa27871cd5e4 (128 octets)PBKDF2-HMAC-SHA512 c74319d99499fc3e9013acff597c23c5baf0a0bec5634c46b8352b793e324723d55caa76b2b25c43402dcfdc06cdcf66f95b7d0429420b39520006749c51a04ef3eb99e576617395a178ba33214793e48045132928a9e9bf2661769fdc668f31798597aaf6da70dd996a81019726084d70f152baed8aafe2227c07636c6ddece (128 octets)PBKDF2-HMAC-SM3 30530b86537c85ea33fbe26ee0adea8d8bd91d283b87936f400e83ad2364ef2632cd8662313657c0e6138ffeda2c4e6805869cbd8030188858d8a675ac762523de72d43ea3dafc36af7e6a8f1a9be8a553e1db7f24926854fa9e40dd64cbcb0628ceb8cf966ff9cc451a5815c847ac0b65c746cf3315839d13d9f43459167e5e (128 octets)Test Case 8Input:P Password (8 octets)S NaCl (4 octets)c 80000dkLen 128Output:PBKDF2-HMAC-SHA224 bebbdf809d53fc84531d0abe06679a8c8526fde47b47245634186908335857334a7578543f9241726d845ee8e575105e4a733b5dcaefa7560af3d028eccf95937535918dbaa84269fc0586711e7a5b9dc0d4c28fc7a89469db7ff5829b8fc1ef709d7ef95c6c7db24cece88f7c1408c8e7cee55c84db0eebb8d8e419bb50e17b (128 octets)PBKDF2-HMAC-SHA256 4ddcd8f60b98be21830cee5ef22701f9641a4418d04c0414aeff08876b34ab56a1d425a1225833549adb841b51c9b3176a272bdebba1d078478f62b397f33c8d62aae85a11cdde829d89cb6ffd1ab0e63a981f8747d2f2f9fe5874165c83c168d2eed1d2d5ca4052dec2be5715623da019b8c0ec87dc36aa751c38f9893d15c3 (128 octets)PBKDF2-HMAC-SHA384 11c198987730fa113458053cd5cc9b51d7024a35f9134f1ee8740923c901aab23bbaea43686981b6e6a9f4130a1401daeeec74060246ebac958f3cfc3c65579b6e3d08b94ade5fc257a6902a0a1664b8dbd5a8ae2af70438931d3f3679abffc7a17770582f1ee413cc0d9914ce5f8143c8a7dc9c43fbc31e3d41b2030fb73c02 (128 octets)PBKDF2-HMAC-SHA512 e6337d6fbeb645c794d4a9b5b75b7b30dac9ac50376a91df1f4460f6060d5addb2c1fd1f84409abacc67de7eb4056e6bb06c2d82c3ef4ccd1bded0f675ed97c65c33d39f81248454327aa6d03fd049fc5cbb2b5e6dac08e8ace996cdc960b1bd4530b7e754773d75f67a733fdb99baf6470e42ffcb753c15c352d4800fb6f9d6 (128 octets)PBKDF2-HMAC-SM3 6064dd50568a7cd0fab52aea443fd71c6f45044fd0aede5928568be7948a34699d2bfce8a435110f551cc0e1814602c03c11ecb7f951fec50602850a5102cb88cd3a8af7aefaa4b08cb8e4c98a1a0ebac0cc9842f4be4e63469afff575197899f51e3537d086eb7f8720ba8534bf82e4f270c6a4d42e1a34866f81023f59f9a0 (128 octets)Test Case 9Input:P Password (8 octets)S sa\0lt (5 octets)c 4096dkLen 256Output:PBKDF2-HMAC-SHA224 a329a360c825e12e454ad8633a842a06ba1456907770779d1fa4e0b61a5b1c6ce02e71de74ae433bbf14b907690d008d0cab5b01c976c1e627b027a9a809fd001082c809650344ecfcdebdf0d64b92cb1e869bf91b75517ea36918127b1eccc4cac145fb965071292a6dfa388d8ad893d2541f83a0dac1c55d2d90709963b066de985e92974e87b7d8c0e8026d96684bb0425203919b4792962b065e2b2b815ba888b8428ae51f57a74f637a658e27cf5fbc5593e85f775a1f81660850a723e2eb565f30dfc2cf2973ad57ec95b89c0979c7bab81c11d8987540a32badb2f7bbe4ff21a4f0d91dbd911b88ddd928603fd27b0ede994ee99edd2c04667b82067f (256 octets)PBKDF2-HMAC-SHA256 436c82c6af9010bb0fdb274791934ac7dee21745dd11fb57bb90112ab187c495ad82df776ad7cefb606f34fedca59baa5922a57f3e91bc0e11960da7ec87ed0471b456a0808b60dff757b7d313d4068bf8d337a99caede24f3248f87d1bf16892b70b076a07dd163a8a09db788ae34300ff2f2d0a92c9e678186183622a636f4cbce15680dfea46f6d224e51c299d4946aa2471133a649288eef3e4227b609cf203dba65e9fa69e63d35b6ff435ff51664cbd6773d72ebc341d239f0084b004388d6afa504eee6719a7ae1bb9daf6b7628d851fab335f1d13948e8ee6f7ab033a32df447f8d0950809a70066605d6960847ed436fa52cdfbcf261b44d2a87061 (256 octets)PBKDF2-HMAC-SHA384 cf6f194aaf4e970afea1f41169045029e34759e124a670b5f73053da552a190ad2d7085533b8b22901f0e3caeeb431ba673468f981352dfcbe517699db791777cf52346a460b093c59ea300fb18daee270e2ea8473806da1663cebe7438b51fe56ba832c13d88ad5b2e46404457c34cc6ad8e5cd8707a1acfa737f3617628a5983d8d10fa16a92652cfa736d4610132710a517c216cc3252e6c2b8aae0275d04a49756fa5bf1bb067bc367d1b8c80c3df7dc22ee74b4be4150871624bfdde3f86f5fbd4e0828af7d5a4f01b5605e54471435d827eaecf199db315ae60d1a6350105c0e1a71b40518a4a66ebba4792a511f8f52aeac961ebea215f8fb89ba998b (256 octets)PBKDF2-HMAC-SHA512 10176fb32cb98cd7bb31e2bb5c8f6e425c103333a2e496058e3fd2bd88f657485c89ef92daa0668316bc23ebd1ef88f6dd14157b2320b5d54b5f26377c5dc279b1dcdec044bd6f91b166917c80e1e99ef861b1d2c7bce1b961178125fb86867f6db489a2eae0022e7bc9cf421f044319fac765d70cb89b45c214590e2ffb2c2b565ab3b9d07571fde0027b1dc57f8fd25afa842c1056dd459af4074d7510a0c020b914a5e202445d4d3f151070589dd6a2554fc506018c4f001df6239643dc86771286ae4910769d8385531bba57544d63c3640b90c98f1445ebdd129475e02086b600f0beb5b05cc6ca9b3633b452b7dad634e9336f56ec4c3ac0b4fe54ced8 (256 octets)PBKDF2-HMAC-SM3 bb8bd18ee4f075590511b7cf913729958c7a8df452f2fff43ff652a10cbe4359d880d6fbfc71019a322e3e4f505c7e86a0a239d81ce365971b80f3a5c77f224eeac12c1a6024298319082adc902d7409d0e8fc6563d620cf6f712a539c5c2b4e0b94501ac7e41c515b4cd23f4c4d07631ff3dea9ea5f90fa0277e352287e0fbff92896e37a948f70276dab4746bbd415baf129ef0a30a4a96b3c5d40b7c15b69bb125b901fec06f92ff347359bfc701e8b4a547eb5d4a5504d764d2b8b4ffef9ecd46ee3aa1c40fc215e93ed026cd2e1ac70f833b3caa22e5cc9996bc429734626886f70492f34e6e1502cc638cf91d00145c8dca0e29ed893ed7c32354f09a1 (256 octets)Test Case 10 杂合集Input:P (0 octets)S salt (4 octets)c 1dkLen 20Output:PBKDF2-HMAC-SHA1 a33dddc30478185515311f8752895d36ea4363a2 (20 octets)PBKDF2-HMAC-SHA256 f135c27993baf98773c5cdb40a5706ce6a345cde (20 octets)PBKDF2-HMAC-SHA512 00ef42cdbfc98d29db20976608e455567fdddf14 (20 octets)PBKDF2-HMAC-SM3 8388dd3999fb0cde4064a6a3f5c1a5963bf4e2cd (20 octets)Test Case 11 OtherInput:P password (8 octets)S saltSALTsaltSALTsaltSALTsaltSALTsalt (36 octets)c 4096dkLen 20Output:PBKDF2-HMAC-SHA1 043c508e57c6427036fd2c6cd2a02ec7530a412c (20 octets)PBKDF2-HMAC-SM3 ac0b5c333e6422266dc13e1763ea552fa9e6cbbd (20 octets)................................................................................Input:P 7charpw (7 octets)S saltSALTsaltSALTsaltSALTsaltSALTsalt (36 octets)c 4096dkLen 20Output:PBKDF2-HMAC-SHA256 2764a19fdf2c10c0f0782eb80afeb7c3813d36d5 (20 octets)PBKDF2-HMAC-SM3 43ea8b03b386a3c1339f33ae45bde26ed5f192ee (20 octets)................................................................................Input:P SomeModuleInsistOn20 (20 octets)S saltSALTsaltSALTsaltSALTsaltSALTsalt (36 octets)c 4096dkLen 20Output:PBKDF2-HMAC-SHA256 cba2e3bf10cd9c9f0cb2d6b2dfa62bfc2b3a7fca (20 octets)PBKDF2-HMAC-SM3 24e2695bf5b035e1e411f6bdd6949fa805fb1b73 (20 octets)