~/moritzsamrock_

Key Stretching

Key Stretching: Computationally intensive derivation of a key from a password to make guessing attacks more difficult. Secure implementation depends in particular on suitable algorithms, correct key management, verified implementationsImplementationThe practical realization of a security design, requirement, or control in a system or process., and a controlled chain of trust.

How it works and where it fits

The security of Key Stretching comes from the combination of algorithm, parameters, keys, protocol, and implementation. A mathematically strong primitive can be defeated by an unsuitable mode, weak randomness, incorrect certificate validation, or exposed keys. The intended objective must therefore be explicit: confidentiality, integrity, authenticity, or non-repudiation.

Practical security relevance

In practice, key and certificate management is often more decisive than algorithm choice alone. Generation, storage, distribution, rotation, revocation, and destruction require defined controls and monitoring. Compatible parameters, maintained libraries, migration capability, and a response process for compromised keys are also necessary; proprietary cryptographic constructions should be avoided.

  • Key Derivation FunctionKey Derivation FunctionDerives cryptographically suitable keys from passwords or keys.: Derives cryptographically suitable keys from passwords or keys.
  • Rainbow TableRainbow TablePrecomputed data structure for the rapid recovery of weakly hashed passwords.: Precomputed data structure for the rapid recovery of weakly hashed passwords.
  • Brute-Force AttackBrute-Force AttackSystematic trial-and-error testing of numerous access credentials or cryptographic keys.: Systematic trial-and-error testing of numerous access credentials or cryptographic keys.
  • Passwordless AuthenticationPasswordless AuthenticationAuthentication that does not rely on a shared password, such as through passkeys or hardware tokens.: Authentication that does not rely on a shared password, such as through passkeys or hardware tokens.

Related terms