What is PBKDF2?
PBKDF2, the Password-Based Key Derivation Function 2, turns a password into cryptographic key material by running a pseudorandom function, almost always HMAC with SHA-256 or SHA-512, over and over. It comes from RSA Laboratories' PKCS #5 version 2.0, published as RFC 2898 in 2000 and updated as RFC 8018 in 2017, and NIST covers its use in SP 800-132. It serves two purposes: deriving encryption keys from passphrases, and producing password hashes that are expensive to crack.
How PBKDF2 works
PBKDF2 takes four inputs: the password, a salt, an iteration count and the length of output required. For each block of output it computes an HMAC of the salt and a block number, keyed with the password, then feeds that result through HMAC again, and again, for the full iteration count, XORing every intermediate value together. At 600,000 iterations, a single guess costs 600,000 HMAC computations instead of one. The salt makes the output unique to each account or file, and the iteration count is the work factor that defenders raise as hardware improves.
One detail catches implementers out. Requesting more output than the hash produces, such as 64 bytes from HMAC-SHA-256, makes the defender run the entire chain twice, yet an attacker can test each guess against the first block alone. Choosing a hash whose output length matches what is needed avoids paying for nothing.
PBKDF2 in practice
Python's standard library computes it in one call: hashlib.pbkdf2_hmac('sha256', password, salt, 600_000). OWASP currently recommends 600,000 iterations for PBKDF2-HMAC-SHA256 and 210,000 for PBKDF2-HMAC-SHA512. Frameworks store the parameters with each hash; Django, for example, keeps passwords in the form pbkdf2_sha256$iterations$salt$hash, so the iteration count can be raised for new hashes without breaking old ones.
PBKDF2 also derives keys for stored data. The original LUKS1 format for Linux disk encryption uses it to turn a passphrase into the key that unlocks the volume key, and many password managers derive their vault keys from the master password with it. Iteration counts matter in that role too. After the 2022 LastPass breach, in which attackers copied encrypted customer vault backups, attention turned to older accounts whose PBKDF2 iteration counts had been left far below the then-current default of 100,100, making those vaults cheaper to attack offline.
Strengths and weaknesses
PBKDF2's main advantage is approval. It is the password-based key derivation function NIST accepts, so it is the usual choice in products that must use FIPS 140-validated cryptographic modules, and it is available in virtually every language and platform. Its weakness is that it needs almost no memory. GPUs and custom chips can run thousands of PBKDF2 computations side by side, so an attacker's cost per guess drops much faster than the defender's, which is why OWASP ranks memory-hard Argon2id and scrypt ahead of it for new systems that aren't bound by FIPS rules.
PBKDF2 vs. bcrypt vs. HKDF
bcrypt and Argon2 are purpose-built password hashing functions; PBKDF2 is a general construction wrapped around HMAC. HKDF, another HMAC-based function, looks similar but does the opposite job: it quickly expands an already strong secret, such as a Diffie-Hellman result, into several keys, and has no work factor because its input can't be guessed. Running a password through HKDF would be a mistake. PBKDF2 also replaced the older PBKDF1, whose output could be no longer than its underlying hash.
PBKDF2 on the CompTIA Security+ exam
SY0-801 no longer lists key stretching, the job PBKDF2 does, as a separate item. PBKDF2 falls under secure password storage and key derivation, taught with salting and hashing algorithms under objective 1.3, the cryptographic solutions objective. Wording such as "derive an encryption key from a user's passphrase", "password storage must use a FIPS-approved method" or "raise the iteration count" points to PBKDF2. Distractors include a single round of SHA-256, which is fast, encrypting the password, which is reversible, and HKDF, which isn't designed for guessable inputs.