1
$\begingroup$

To allow the key to be more easily remembered.

Example: To encrypt a hard drive without having a remember a key with 128 bits of entropy.

From what I find they seem mostly used to hash passwords so the password database is more resistant to brute force in the case it's compromised. (compared to using a regular hash function)

So I'm not sure that the use case that I mentioned would be safe.

|improve this question
$\endgroup$
  • $\begingroup$ Sure you can (and should) apply a strong PBKDF when using passwords. This is standard practice for Full Disk Encryption to recover the full entropy bulk encryption keys. $\endgroup$ – SEJPM♦ Feb 26 '16 at 20:50
2
$\begingroup$

Yes, with caveats.

Yes, because this is the entire stated point of password-based key derivation functions (e.g., PBKDF2 or scrypt). The caveat is that more iterations only get you so much; 100,000 iterations is only enough to increase "effective" entropy by a little over 16 bits ($100,000 \approx 2^{16}$) — to match a real 128-bit key, you'd need a password with 112 bits of entropy, which is an impractical 19-character alphanumeric password.

One approach without this caveat is to use a PBKDF to derive an actual encryption key from a key and password; this has the benefits of both systems. There's a real 128-bit (or 256-bit) secret that protects the data, which is typically invisible to a user, but you require a password to access and use that key.

|improve this answer
$\endgroup$
  • $\begingroup$ > There's a real 128-bit (or 256-bit) secret that protects the data, which is typically invisible to a user, but you require a password to access and use that key. Instead to brute forcing the data, an attacker would brute force the key, what would it change? $\endgroup$ – tuxayo Mar 7 '16 at 9:36
  • $\begingroup$ Brute forcing data doesn't make sense, and brute forcing a 128-bit key is outside of the realm of plausibility. The point of such a scheme is that an attacker can't simply guess passwords without also having the secret key. $\endgroup$ – Stephen Touset Mar 7 '16 at 19:18
  • $\begingroup$ ok, I didn't understood that encryption_key = KDF(password, key). By brute forcing the data I meant that the attacker will brute force the key to decrypt the data. But that's invalidated by because I misunderstood what you explained. Can you confirm that you proposal is only useful when the attacker can access only the data and not the key? And what could be such situations? $\endgroup$ – tuxayo Mar 13 '16 at 10:54
  • $\begingroup$ No cryptosystem is useful if an attacker can access the data and key. $\endgroup$ – Stephen Touset Mar 14 '16 at 21:51
  • $\begingroup$ «derive an actual encryption key from a key and password» Then the key must be stored in the same support as the data. I don't get the benefit. $\endgroup$ – tuxayo Mar 19 '16 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.