Усиление криптографических ключей для защиты от перебора

Increasing the time needed to test a cryptographic key to protect against brute force attack

In cryptography, key stretching techniques are used to make a possibly weak key, typically a password or passphrase, more secure against a brute force attack by increasing the resources (time and possibly space) it takes to test each possible key. Passwords or passphrases created by humans are often short or predictable enough to allow password cracking, and key stretching is intended to make such attacks more difficult by complicating a basic step of trying a single password candidate. Key stretching also improves security in some real world applications where the key length has been constrained, by mimicking a longer key length from the perspective of a brute force attacker. There are several ways to perform key stretching. One way is to apply a cryptographic hash function or a block cipher repeatedly in a loop. For example, in applications where the key is used for a cipher, the key schedule in the cipher may be modified so that it takes a specific length of time to perform. Another way is to use cryptographic hash functions that have large memory requirements – these can be effective in frustrating attacks by memory bound adversaries.

The first deliberately slow password based key derivation function "CRYPT" was described in 1978 by Robert Morris for encrypting Unix passwords. It used an iteration count of 25, a 12 bit salt and a variant of DES as the sub function. (DES proper was avoided in an attempt to frustrate attacks using standard DES hardware.) Passwords were limited to a maximum of eight ASCII characters. While it was a great advancement for its time, CRYPT(3) is now considered inadequate. The iteration count, designed for the PDP 11 era, is too low, 12 bits of salt is an inconvenience but does not stop precomputed dictionary attacks, and the eight character limit prevents the use of stronger passphrases. Modern password based key derivation functions, such as PBKDF2, use a cryptographic hash, such as SHA 2, a longer salt (e. g. 64 bits) and a high iteration count. The U. S. National Institute of Standards and Technology (NIST) recommends a minimum iteration count of 10,000. "For especially critical keys, or for very powerful systems or systems where user perceived performance is not critical, an iteration count of 10,000,000 may be appropriate.”

In 2009, a memory intensive key strengthening algorithm, scrypt, was introduced with the intention of limiting the use of custom, highly parallel hardware to speed up key testing. In 2013, a Password Hashing Competition was held to select an improved key stretching standard that would resist attacks from graphics processors and special purpose hardware. The winner, Argon2, was selected on July 1, 2015.