# Is it possible to increase the encryption security of a short key?

If I encrypt a file with a short 4 digit pin is there any way to make it more secure. I've thought about hashing the 4 digit pin and using the result as the encryption key. I think this would work as long as the attacker didn't know that I was using this strategy but if they did they could just try the 10^4 hashing of the possible pins.

• Is it easy to crack a hashed phone number? Commented Apr 8, 2021 at 20:04
• I. Believe this is possible by embedding the 4digit pin in an alpha string. Eg aefgyreju1234jhfds and sha the string twice. Here is another example: 76530964CraigWrightIsSatoshiNakamoto87643 Commented Sep 24, 2021 at 16:15

The hash idea isn't great. See Kerckhoffs's principle. The underlying secret is still the four digit PIN, which is only $$4 \times -\log_2(10) = 13$$ bits of security. And don't we all pick '1234' anyway?

You can use a key derivation function like Argon2 (there are others). That slows down hackers attempts at guessing your PIN. You could aim for something like one second on typical hardware. Still it could be brute forced after a mean time of an hour and a quarter on that same kit though.

Security could be further enhanced with an $$n$$ tries and you're locked out policy if there is a server involved with conditional logic. This would be implemented by also using the derived encryption key to encrypt a series of four check digits, say all zero. If they do not decrypt to all zero, it's the wrong PIN, so try again until lock out. This is how your ATM card behaves.

And a further further method would be to have an increasing/exponential delay between attempts. This would depend on your customers' acceptance though.

A longer pin is an option if the business allows it. Windows login PINs are six digits.

Fundamentally, there isn't, because there's way too few combinations. You can however look into some practical measures some systems use to mitigate weak PINs or passwords like these.

One technique is to combine the PIN or weak passwords with a strong secret key that the user however is not required to memorize or manage. Perhaps most famous example is how Apple iOS devices bake a 256-bit secret key into their CPU's secure enclave and derive the master encryption key from the phone PIN and that secret key. This means that an attacker who just clones the phone's disk isn't able to decrypt it off the device. As this Security Stack Exchange answer puts it:

At the core of the system, there is a device-specific key called the UID-key; it is stored in the CPU itself and each CPU has its own. From that key are derived other keys, including the one used for KeyChain; the user's passcode is also used in the key derivation. The CPU is assumed to be tamper-resistant, which means that you should not be able to extract the UID-key from it. If you access the hardware directly, you can make the CPU use the UID-key, but any brute force attack on the passcode will need to go through the actual CPU.

In addition to this the devices guard against PIN-guessing by slowing down after repeated failed guesses. But even with these protections, Apple several years ago stopped allowing 4-digit PINs and now requires a minimum of 6 digits.

Second example: the 1Password password manager mitigates against weak master passwords by creating a strong Secret Key for each user and, instead of demanding that the user memorize it (which is impractical), asking them to print out an "Emergency Kit" that contains a textual copy of the secret key and store it in a physically secure location: