Which technique strengthens potentially weak input for cryptographic key generation, such as passwords or passphrases created by people, against brute force attacks?

Which technique strengthens potentially weak input for cryptographic key generation, such as passwords or passphrases created by people, against brute force attacks?

• A. Key stretching
• B. Hashing
• C. Salting
• D. Encryption

Answer: (A)

Key stretching is used to make weak inputs, like human-created passwords, much harder to brute-force when they’re used to derive cryptographic keys. By running the password through a deliberately slow, resource-intensive process—usually a password-based key derivation function with many iterations and often a salt—the amount of work required to test each guess increases dramatically. This means an attacker can try far fewer guesses per second, significantly slowing offline attacks. This is typically implemented with functions such as PBKDF2, bcrypt, scrypt, or Argon2, which are designed to be computationally expensive and, in some cases, memory-hard. The salt component helps by ensuring identical passwords don’t yield the same derived key, preventing the use of precomputed tables and making attacks unique to each password instance. Hashing alone is usually too fast to deter brute-force attempts unless it’s iterated many times, and salting by itself doesn’t slow down an attacker—its primary purpose is to defeat precomputed attacks. Encryption, while crucial for protecting data, isn’t used to strengthen the process of deriving a key from a password against brute-force guessing.

Key stretching is used to make weak inputs, like human-created passwords, much harder to brute-force when they’re used to derive cryptographic keys. By running the password through a deliberately slow, resource-intensive process—usually a password-based key derivation function with many iterations and often a salt—the amount of work required to test each guess increases dramatically. This means an attacker can try far fewer guesses per second, significantly slowing offline attacks.

This is typically implemented with functions such as PBKDF2, bcrypt, scrypt, or Argon2, which are designed to be computationally expensive and, in some cases, memory-hard. The salt component helps by ensuring identical passwords don’t yield the same derived key, preventing the use of precomputed tables and making attacks unique to each password instance.

Hashing alone is usually too fast to deter brute-force attempts unless it’s iterated many times, and salting by itself doesn’t slow down an attacker—its primary purpose is to defeat precomputed attacks. Encryption, while crucial for protecting data, isn’t used to strengthen the process of deriving a key from a password against brute-force guessing.