Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I recently learned about the hashing algorithm bcrypt, which allows you to specify a "work factor" for the hash which can be incremented to stay ahead of Moore's Law. I understand there are some other hashing algorithms that also do this.

Are there any two-way encryption algorithms with this property? For example, I'd like to be able to encrypt a file such that it takes a couple of seconds with today's machines to decrypt it using the correct key, and therefore someone who is trying to guess the key will be severely rate-limited.

share|improve this question
add comment

1 Answer

up vote 9 down vote accepted

You can use bcrypt to derive a (long enough) key from your initial secret value, and then use the key for symmetric encryption. "Guessing" the key is an issue only when the key is part of a space of possible keys which is small enough that such guessing is a possibility -- i.e. when the "secret value" is a password. A 128-bit uniformly random key is immune to guessing by virtue of being part of a space of size $2^{128}$. So use bcrypt with your work factor, truncate the result to 128 bits, use AES, and you're done: any guessing will have to work with the password, and will thus greatly suffer from the bcrypt work factor.

share|improve this answer
Take care to take the hash part of the output, not the part which contains the salt and work factor, though :-) –  Paŭlo Ebermann Dec 6 '11 at 14:33
@OliverS: you cannot brute force a random 128-bit key; that would require way more force than is available on Earth. If brute force is doable, then it must operate on the input of bcrypt -- so bcrypt has to be used. –  Thomas Pornin Dec 6 '11 at 16:25
@OliverS: ah, well, the usual problem of inferring the "right question". An attacker trying to guess the encryption key itself will not be impaired by the bcrypt work factor, but by the whole "guessing a 128-bit random key" being downright unfeasible. So I am responding to the sensible question, which is: assuming that the source secret value is amenable to guessing (i.e. is from a much smaller space), how do we secure that in the context of symmetric encryption, with a work factor as bcrypt does ? And the answer is: well, use bcrypt, it works for that too. –  Thomas Pornin Dec 6 '11 at 17:13
The answer is way better now with the clarifications. Maybe add another point that using bcrypt for key deriving would be a good measure to slow down dictionary attacks. –  OliverS Dec 7 '11 at 8:20
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.