Dynamic Password Key Derivation Iteration Count
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password-based key derivation functions, such as PBKDF2, require a fixed high iteration count to impede attacks, which increases computational cost for both attackers and authorized users, and may not be necessary for strong passwords.
Innovation Solution
A system dynamically computes the iteration count based on the strength of the password, with weaker passwords requiring higher iteration counts and stronger passwords requiring lower counts, using metrics such as length, dictionary presence, compression efficacy, and character strength to adjust the number of times a cryptographic function is executed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a fixed high iteration count is used to impede dictionary and brute-force attacks, then security against attacks is improved, but the computational cost for authorized users increases
Solution Approach 1:
The patent applies dynamics by making the iteration count variable rather than fixed. The system dynamically adjusts the iteration count based on password strength assessment - weaker passwords receive higher iteration counts for enhanced security, while stronger passwords receive lower iteration counts to reduce computational overhead. This dynamic adaptation resolves the contradiction by optimizing the balance between security and computational cost for each individual password.
Solution Approach 2:
The patent changes the parameter of iteration count from a fixed value to a variable value determined by password strength. By assessing password strength using various metrics (entropy, character variety, length) and adjusting the iteration count accordingly, the system transforms a static security parameter into a dynamic one that adapts to the specific password being processed, thereby resolving the trade-off between security and computational cost.
2Reliability
If a high iteration count is used to strengthen weak passwords, then security for weak passwords is improved, but the key derivation process becomes slower
Solution Approach 1:
The patent applies local quality by applying different iteration counts to different passwords based on their individual strength characteristics. Instead of uniformly applying a high iteration count to all passwords, the system assesses each password's strength locally and applies the appropriate level of computational work. This ensures that weak passwords receive enhanced strengthening while strong passwords are not unnecessarily slowed down.
Solution Approach 2:
The system dynamically adjusts the iteration count based on real-time password strength assessment. By evaluating password characteristics and computing an appropriate iteration count for each case, the system creates a dynamic key derivation process that adapts to the specific input, resolving the contradiction between strengthening weak passwords and maintaining overall key derivation speed.
3Ease of manufacture
If a fixed iteration count is used for all passwords, then the key derivation process is simple to implement, but it cannot optimize resource usage based on password strength
Solution Approach 1:
The patent applies preliminary action by assessing password strength before determining the iteration count. The system performs an initial evaluation of the password using various strength metrics (length, character variety, entropy, dictionary checks) and uses this assessment to pre-determine the appropriate iteration count before the actual key derivation process begins. This preliminary assessment enables optimized resource usage while maintaining implementation feasibility.
Solution Approach 2:
The system incorporates feedback by using password strength assessment results to adjust the iteration count. The feedback loop evaluates password characteristics, determines an appropriate security level, and adjusts computational parameters accordingly. This feedback mechanism enables the system to optimize resource usage based on actual password strength while maintaining a relatively simple implementation structure.
Data Source
AI summary
A password-based key derivation function includes a sub-function that gets executed multiple times based on an iteration count. A key derivation module computes the iteration count dynamically with each entered password. The iteration count is computed as a function of the password strength. Specifically, the weaker the password, the higher the iteration count; but the stronger the password, the smaller the interaction count. This helps strengthen weaker passwords without penalizing stronger passwords.