Question

I’m using CCKeyDerivationPBKDF to generate and verify password hashes in a concurrent environment and I’d like to know whether it it thread safe. The documentation of the function doesn’t mention thread safety at all, so I’m currently using a lock to be on the safe side but I’d prefer not to use a lock if I don’t have to.

Answer 1

After going through the source code of the CCKeyDerivationPBKDF() I find it to be “thread unsafe”. While the code for CCKeyDerivationPBKDF() uses many library functions which are thread-safe(eg: bzero), most user-defined function(eg:PRF) and the underlying functions being called from those user-defined functions, are potentially thread-unsafe. (For eg. due to use of several pointers and unsafe casting of memory eg. in CCHMac). I would suggest unless they make all the underlying functions thread-safe or have some mechanism to alteast make it conditionally thread-safe, stick with your approach, or modify the commoncrypto code to make it thread-safe and use that code.

Hope it helps.