0
$\begingroup$

With the ever increasing risk of attackers compromising password based encryption by brute forcing or guessing passwords, are there alternatives to this traditional scheme of deriving encryption keys from passwords. I realize that there are memory hard hash functions like Argon2 that creates derived keys from passwords, and because of the memory hardness slows down brute forcing to some extent. But still, if the password is weak in the first place and if the salt is known to the attacker, then brute force becomes trivial, considering ever increasing rate of computational power, provided by GPUs, ASICs etc. Further more, when considering the problems associated with file encryption, where it is required to generate a key (256 bits) to use in a symmetric encryption algorithm like AES, there is not a better user friendly method than asking the user for a password or a passphrase. Also, if we consider biometric methods like fingerprint detection, it is almost impossible as of now, to derive the same encryption key from biometric data all the time.

But are there, other methods, most preferably software techniques that I'm not aware of?

$\endgroup$
2
$\begingroup$

Hardware tokens (such as smart cards, FIDO U2F keys, and other secure storage elements), and normal files can all directly store cryptographic keys. For example, it's recommended to configure SSH servers to only use cryptographic key files.

$\endgroup$
4
  • $\begingroup$ Thankyou for your answer, but are there software solutions? $\endgroup$ – Vivekanand V Aug 27 '20 at 20:34
  • 1
    $\begingroup$ Yes, key files, like the mentioned SSH key files. $\endgroup$ – SAI Peregrinus Aug 27 '20 at 20:35
  • $\begingroup$ But generating SSH files, and it's safe storage become another challenge for the end user? $\endgroup$ – Vivekanand V Aug 27 '20 at 20:37
  • 1
    $\begingroup$ Yes, but the generation is handled by SSH. Safe long-term storage of proof of identity is always either difficult (software-only) or costs money (hardware token). $\endgroup$ – SAI Peregrinus Aug 27 '20 at 20:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.