Warm tip: This article is reproduced from stackoverflow.com, please click
.net-core c# hash security

What's the difference between KeyDerivation.Pbkdf2 and Rfc2898DeriveBytes?

发布于 2020-03-28 23:15:01

KeyDerivation in MSDN:

Performs key derivation using the PBKDF2 algorithm.

Rfc2898DeriveBytes in MSDN:

Implements password-based key derivation functionality, PBKDF2, by using a pseudo-random number generator based on HMACSHA1.

Aren't those the same things? We can set the hashing algorithm in both methods.

Questioner
SpiritBob
Viewed
130
SpiritBob 2020-01-31 18:30

Both functions do the same thing (when both used with the same parameters, they generate the same cryptographic key).

The only difference in their design, is that Rfc2898DeriveBytes offers much more algorithms for encryption, whereas KeyDerivation offers less and is also a package that needs to be downloaded. (Exists pre-installed only in ASP.NET/ASP.NET Core, unless I'm mistaken.)

From a performance perspective (benchmarks are my own), at one point KeyDerivation was much faster, especially in SHA-1 computations, but after testing for 10 to 15 minutes straight, it seems they evened out, so I can't really say which is more efficient. What I can say is that you'll need an extra assignment for Rfc2898DeriveBytes, which you will either immediately dispose, or re-use throughout your application's lifespan, whereas KeyDerivation does not need any ceremonies in its usage. That of course, comes at the price of its limited algorithms.

If you constantly dispose and instance a new Rfc2898DeriveBytes (not re-used, which is 90% of the time due to inability to change the supplied password), I believe KeyDerivation is much, much faster. (My benchmarks showed 50% penalty in speed.)