3

To quote from this wiki article -

An alternative approach, called key strengthening, extends the key with a random salt, but then (unlike in key stretching) securely deletes the salt. This forces both the attacker and legitimate users to perform a brute-force search for the salt value.

I am comfortable with what key stretching does, But I am confused on how key strengthening is achieved. How the key can be validated again if the salt is deleted?

3 Answers 3

5

The paper on the key strengthening scheme cited in the wiki article is available here.

It seems they're breaking a larger salt up into two smaller salts, a public salt, which is no different than normal salting, and a private salt, which is discarded in order to make password verifications slower. The idea is that all password verifications will be slower because the private salt must always be brute-forced but this will be negligible when the correct password is provided. However, the added processing will slow down brute forcing of the password.

1
  • Is it possible for you to give the name of the paper? Link is dead.
    – Michael C.
    Commented Jan 11, 2023 at 10:51
4

By using a salt that's short enough that it's feasible to try all of the possibilities until you find one that decrypts the message when combined with the known key. Hence "a brute-force search for the salt value".

0
0

Like all other answers said, brute-forcing is needed in every validation of password. However unlike those done by hackers which are guessing the whole password from scratch, the authentic user can provide the password which acts as a very good foundation for the brute-force search of the remaining part (which is the deleted salt), and hence speeding up the search and hold the validation time under control.

So the key is: Given the authentic user knows the password, it is easy to calculate a matching hash by brute-force.

Side note: like @pizen said in the above answer, we still need a public salt, instead of deleting all the salts. Otherwise it is just defeating the purpose of salting.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.