5
$\begingroup$

I recently learned about the hashing algorithm bcrypt, which allows you to specify a "work factor" for the hash which can be incremented to stay ahead of Moore's Law. I understand there are some other hashing algorithms that also do this.

Are there any two-way encryption algorithms with this property? For example, I'd like to be able to encrypt a file such that it takes a couple of seconds with today's machines to decrypt it using the correct key, and therefore someone who is trying to guess the key will be severely rate-limited.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
10
$\begingroup$

You can use bcrypt to derive a (long enough) key from your initial secret value, and then use the key for symmetric encryption. "Guessing" the key is an issue only when the key is part of a space of possible keys which is small enough that such guessing is a possibility -- i.e. when the "secret value" is a password. A 128-bit uniformly random key is immune to guessing by virtue of being part of a space of size $2^{128}$. So use bcrypt with your work factor, truncate the result to 128 bits, use AES, and you're done: any guessing will have to work with the password, and will thus greatly suffer from the bcrypt work factor.

Improve this answer
$\endgroup$
4
  • 2
    $\begingroup$ Take care to take the hash part of the output, not the part which contains the salt and work factor, though :-) $\endgroup$
    – Paŭlo Ebermann
    Dec 6, 2011 at 14:33
  • $\begingroup$ @OliverS: you cannot brute force a random 128-bit key; that would require way more force than is available on Earth. If brute force is doable, then it must operate on the input of bcrypt -- so bcrypt has to be used. $\endgroup$
    – Thomas Pornin
    Dec 6, 2011 at 16:25
  • 2
    $\begingroup$ @OliverS: ah, well, the usual problem of inferring the "right question". An attacker trying to guess the encryption key itself will not be impaired by the bcrypt work factor, but by the whole "guessing a 128-bit random key" being downright unfeasible. So I am responding to the sensible question, which is: assuming that the source secret value is amenable to guessing (i.e. is from a much smaller space), how do we secure that in the context of symmetric encryption, with a work factor as bcrypt does ? And the answer is: well, use bcrypt, it works for that too. $\endgroup$
    – Thomas Pornin
    Dec 6, 2011 at 17:13
  • $\begingroup$ The answer is way better now with the clarifications. Maybe add another point that using bcrypt for key deriving would be a good measure to slow down dictionary attacks. $\endgroup$
    – OliverS
    Dec 7, 2011 at 8:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.