Pbkdf2Params

ThePbkdf2Params dictionary of theWeb Crypto API represents the object that should be passed as thealgorithm parameter intoSubtleCrypto.deriveKey(), when using thePBKDF2 algorithm.

Instance properties

name

A string. This should be set toPBKDF2.

hash

A string or an object containing a single property calledname with a string value. It is an identifier for thedigest algorithm to use. This should be one of the following:

SHA-256: selects theSHA-256 algorithm.
SHA-384: selects theSHA-384 algorithm.
SHA-512: selects theSHA-512 algorithm.

Warning:SHA-1 is considered vulnerable in most cryptographic applications, but is still considered safe in PBKDF2. However, it's advisable to transition away from it everywhere, so unless you need to useSHA-1, don't. Use a different digest algorithm instead.

salt

AnArrayBuffer, aTypedArray, or aDataView. This should be a random or pseudo-random value of at least 16 bytes. Unlike the input key material passed intoderiveKey(),salt does not need to be kept secret.

iterations

ANumber representing the number of times the hash function will be executed inderiveKey(). This determines how computationally expensive (that is, slow) thederiveKey() operation will be. In this context, slow is good, since it makes it more expensive for an attacker to run adictionary attack against the keys. The general guidance here is to use as many iterations as possible, subject to keeping an acceptable level of performance for your application.