The scenario: On the one side a user enters a pass phrase to encrypt a stream of data (AES-GCM) and a symmetric encryption key is derived from the pass phrase using plain SHA-256 (so not a slow function). Data is sent using TLS. On the other side another user has to enter the same pass phrase to derive the same key for decryption. If the key is never persisted, does it matter that a fast key derivation function is used?
1 Answer
In Key derivation functions, you enter a secret that is your password, salt, and the number of iterations.
$$key = \operatorname{KDF}(\text{passowrd}, \text{salt}, \text{iterations})$$
The salt is a countermeasure against the rainbow table attacks. The salt also increases the entropy of the produced key. Since the attackers cannot use a rainbow table, they have to use execute password search, the most popular is hashcat where it can utilize GPU's cores. This where the number if iterations become important. If a fast key derivation is used then the password search will be very fast. Think about the usual 10000 iterations vs 1.
In your case, you even didn't mention the salt. Without the salt, a SHA-256 rainbow table can easily find the password if it exists in the table.
As mentioned in the comments, by F.Grieu; The modern Key derivation functions has more parameters. For example; Argon2 has also memorySizeKB
and parallelism
parameters as a countermeasure against GPU and ASIC based passwords search attacks. Without these parameters, the GPUs and ASICs can search the passwords massively in parallel process.
- An 8x Nvidia GTX 1080 can calcaulte 2865.2 MH/s SHA-256 hashes.
You should use the Scrypt or Argon2, the winner of Password Hashing Competition.
-
$\begingroup$ Comments are not for extended discussion; this conversation has been moved to chat. $\endgroup$ Feb 18, 2019 at 20:18
-
$\begingroup$ Please note that the comments contain the answer to the question. $\endgroup$– J.R.Feb 18, 2019 at 21:07