0
$\begingroup$

With the ever increasing risk of attackers compromising password based encryption by brute forcing or guessing passwords, are there alternatives to this traditional scheme of deriving encryption keys from passwords. I realize that there are memory hard hash functions like Argon2 that creates derived keys from passwords, and because of the memory hardness slows down brute forcing to some extent. But still, if the password is weak in the first place and if the salt is known to the attacker, then brute force becomes trivial, considering ever increasing rate of computational power, provided by GPUs, ASICs etc. Further more, when considering the problems associated with file encryption, where it is required to generate a key (256 bits) to use in a symmetric encryption algorithm like AES, there is not a better user friendly method than asking the user for a password or a passphrase. Also, if we consider biometric methods like fingerprint detection, it is almost impossible as of now, to derive the same encryption key from biometric data all the time.

But are there, other methods, most preferably software techniques that I'm not aware of?

$\endgroup$

1 Answer 1

2
$\begingroup$

Hardware tokens (such as smart cards, FIDO U2F keys, and other secure storage elements), and normal files can all directly store cryptographic keys. For example, it's recommended to configure SSH servers to only use cryptographic key files.

$\endgroup$
4
  • $\begingroup$ Thankyou for your answer, but are there software solutions? $\endgroup$
    – Aravind A
    Aug 27, 2020 at 20:34
  • 1
    $\begingroup$ Yes, key files, like the mentioned SSH key files. $\endgroup$ Aug 27, 2020 at 20:35
  • $\begingroup$ But generating SSH files, and it's safe storage become another challenge for the end user? $\endgroup$
    – Aravind A
    Aug 27, 2020 at 20:37
  • 1
    $\begingroup$ Yes, but the generation is handled by SSH. Safe long-term storage of proof of identity is always either difficult (software-only) or costs money (hardware token). $\endgroup$ Aug 27, 2020 at 20:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.