- Say we have a very limited password space with only a 4 digit PIN, so only 10000 PIN possibilities.
- Say also that the attacker has access to the stored form of the PIN.
Can breaking the PIN be made reasonably difficult by storing the PIN in a way that makes the reverse computation impossible, as well as the storing itself really time-intensive?
Of course, arbitrary hashing alone - although usually not reversible - is not sufficient, since the PIN could be bruteforced. But if the hashing takes a sufficiently large amount of time, in theory, bruteforcing is not feasible. Am I missing something here?
One thing that comes to mind if e.g. the hashing takes 60 seconds, is, that that would be a major inconvenience for the user, since a normal log in process would take that long, yet the time to bruteforce is maximum ~7 days.
But, ignoring usability, is security given in this scenario? Meaning: Can the password be retrieved in significantly less than the normalized ~7 computing days?