# What is the purpose of key strengthening?

I recently came across this term and after some research found this article which states the following:

An alternative approach, called key strengthening, extends the key with a random salt, but then (unlike in key stretching) securely deletes the salt. This forces both the attacker and legitimate users to perform a brute-force search for the salt value

That made me wonder, what's the point of using such an approach rather than the traditional key stretching? Are there any real applications employing this method?

• I'm not aware of any system doing that. The only thing it would do is provide an increased work factor to slow down hashing, but modern systems use other methods such as iterating the hash function. Feb 20, 2018 at 23:05
• Perhaps if you were worried that some future attack could "roll up" the hash function, making iteration ineffective? Feb 20, 2018 at 23:21
• see my paragraph on Catena, as well as comments on answer crypto.stackexchange.com/questions/20578/… Feb 21, 2018 at 12:31
• @hobbs Now that would be such an extreme break of a one-way hash function that it is unlikely to the extreme to ever occur. Even MD5 is completely secure with most password hashing functions (that operate on a secure hash, of course). Only the small output size is somewhat of a problem if the password hash is badly designed. Feb 21, 2018 at 14:58
• A disadvantage would be that finding the salt would be a non-constant time operation. When it is found depends rather on luck. So server load and time to find a specific hash / password combination would be hard to establish. This is not something you'd expect on systems without severe constraints. Feb 21, 2018 at 15:01

The idea there seems to have been to use the existing crypt() password hash exactly as-is, and make any modifications outside of it. From the Manber paper, p.5:
Remember that the original crypt() didn't have any means for setting the number of rounds, but was completely fixed. (It also didn't support password longer than 8 characters, so they couldn't just append the salt, but had to apply it by "scrambling" the password with the secret salt.)