- [Instructor] Many encryption technologies
depend upon the ability to create
an encryption key from a password,
in a way that remains strong.
Key stretching technologies
allow this to happen.
The basic idea behind key stretching
is that an algorithm takes
a relatively insecure value,
such as a password,
and manipulates it in a way
that makes it stronger
and more resilient to threats
like dictionary attacks.
Key stretching combines
two different techniques
to add strength to an encryption key.
First, it combines encryption keys
with a value known as a salt,
to modify the key.
This process is known as salting.
Second, it hashes the resulting value
to add time to the key checking process.
This might be less than a second,
but key stretching algorithms
repeat this process
hundreds or thousands of times,
to consume longer amounts of time.
The idea is that
if a user knows the correct password,
the second or two that it takes
to verify the password
is not a big deal.
However, if an attacker is trying
to guess the correct password,
he or she would have to perform
the same calculations for each guess,
making each guess take
a couple of seconds.
That really slows things down
when you're trying to make
millions of guesses.
One algorithm used
to perform key stretching
is the password-based key derivation function, version two,
known more commonly
by its fairly unfriendly acronym
P-B-K-D-F-2.
This function uses salting and hashing
to stretch a key.
Most security professionals recommend
that anyone using this function
repeat the salt/hash process
at least 4,000 times, if not more.
Bcrypt is a similar algorithm.
It's based upon the Blowfish cipher,
and uses that algorithm's hashing approach,
combined with a salt, to strengthen keys.