Skip to main content

Encryption using a key derived from a password or passphrase entered by the user.

In password-based encryption, the encryption key is derived from a password or passphrase entered by the user. Typically, the password may be chosen by the user, and needs to be simple enough to be memorized.

The main challenges in password-based encryption include, on one hand, choosing passphrases that are easy to memorize while still containing sufficient entropy to be difficult to crack by brute force, and on the other hand, dealing with the potentially very limited amount of entropy in user-chosen passwords.

Common solutions include the use of deliberately slow key derivation functions such as PBKDF2 to slow down brute force password guessing attempts, a practice known as key stretching. This is usually combined with salting to prevent the generation of precomputed key/password tables and to avoid leaking information if the same password is used multiple times.

Methods for generating secure and memorizable passphrases are often based on randomly choosing a sequence of common words from a dictionary; systems using this technique include S/KEY and diceware.

See also: