1
$\begingroup$

I recently came across this term and after some research found this article which states the following:

An alternative approach, called key strengthening, extends the key with a random salt, but then (unlike in key stretching) securely deletes the salt. This forces both the attacker and legitimate users to perform a brute-force search for the salt value

That made me wonder, what's the point of using such an approach rather than the traditional key stretching? Are there any real applications employing this method?

Improve this question
$\endgroup$
5
  • 1
    $\begingroup$ I'm not aware of any system doing that. The only thing it would do is provide an increased work factor to slow down hashing, but modern systems use other methods such as iterating the hash function. $\endgroup$
    – SAI Peregrinus
    Feb 20, 2018 at 23:05
  • $\begingroup$ Perhaps if you were worried that some future attack could "roll up" the hash function, making iteration ineffective? $\endgroup$
    – hobbs
    Feb 20, 2018 at 23:21
  • $\begingroup$ see my paragraph on Catena, as well as comments on answer crypto.stackexchange.com/questions/20578/… $\endgroup$
    – Richie Frame
    Feb 21, 2018 at 12:31
  • $\begingroup$ @hobbs Now that would be such an extreme break of a one-way hash function that it is unlikely to the extreme to ever occur. Even MD5 is completely secure with most password hashing functions (that operate on a secure hash, of course). Only the small output size is somewhat of a problem if the password hash is badly designed. $\endgroup$
    – Maarten Bodewes ♦
    Feb 21, 2018 at 14:58
  • $\begingroup$ A disadvantage would be that finding the salt would be a non-constant time operation. When it is found depends rather on luck. So server load and time to find a specific hash / password combination would be hard to establish. This is not something you'd expect on systems without severe constraints. $\endgroup$
    – Maarten Bodewes ♦
    Feb 21, 2018 at 15:01

1 Answer 1

Reset to default
2
$\begingroup$

The sources of that Wikipedia article show that the article describing key strengthening by Manber (adding a subsequently deleted salt) is from 1996, two years before the 1998 article that is given as the origin for key stretching describes (adding more iterations).

The idea there seems to have been to use the existing crypt() password hash exactly as-is, and make any modifications outside of it. From the Manber paper, p.5:

The implementation of this scheme is very easy. In particular, all changes are made as an extra filter to the login procedure, without having to modify the encryption mechanism at all.

Remember that the original crypt() didn't have any means for setting the number of rounds, but was completely fixed. (It also didn't support password longer than 8 characters, so they couldn't just append the salt, but had to apply it by "scrambling" the password with the secret salt.)

Improve this answer
$\endgroup$
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.