Tunable Key Derivation Function Decoupling Memory and Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing password-based key derivation functions in computer security are limited by their dependency on both memory and processing resources, making them vulnerable to brute force attacks, and lack flexibility in adjusting protection strength over time without access to the original passwords.
Innovation Solution
The method decouples processing time from memory requirements, allowing for tunable performance and protection strength through a two-stage core hashing operation with separate iterations and memory block parameters, enabling system administrators to increase protection strength without the original passwords.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If password hashing is used to protect user passwords, then security against unauthorized access is improved, but the system becomes vulnerable to brute force attacks due to limited password space
Solution Approach 1:
The patent applies preliminary action by pre-computing a large array of memory blocks containing pseudo-random data based on the password before any attack occurs. This pre-computed array is then used during authentication to derive the final hash. The preliminary computation creates a computational barrier that must be overcome during any brute force attempt, significantly increasing the cost of such attacks before they even begin.
Solution Approach 2:
The patent uses copying by creating multiple copies of hash computations through the array of memory blocks. Instead of computing a single hash value, the system generates an array of blocks where each block contains a copy or variation of the hashing process. This multiplication of computational copies increases the total work factor for attackers while maintaining the same security goal.
2Reliability
If more memory and processing resources are required for key derivation, then brute force attack cost increases, but normal system performance deteriorates
Solution Approach 1:
The patent applies dynamics by making the memory and processing requirements configurable through parameters. The system can dynamically adjust the number of iterations and the size of the memory array based on security requirements and performance constraints. This dynamic configuration allows administrators to tune the balance between protection strength and system performance rather than being locked into fixed resource requirements.
Solution Approach 2:
The patent uses parameter changes by introducing configurable parameters that control the computational complexity of the key derivation function. By changing parameters such as the number of iterations and array size, the system can adjust both the protection strength and the resource consumption. This allows the same algorithm to provide different levels of security and performance characteristics based on the applied parameters.
3Reliability
If the number of hashing operations is increased to strengthen protection, then brute force resistance improves, but processing time increases
Solution Approach 1:
The patent applies segmentation by dividing the hashing operations into distinct segments or stages. Instead of performing a single long computational sequence, the system breaks down the key derivation into multiple smaller hashing operations that work on different segments of the password or different portions of the generated array. This segmentation allows for better optimization and potential parallelization, reducing overall processing time while maintaining protection strength.
4Reliability
If protection strength is increased over time to counter growing computing power, then security against modern attacks improves, but access to original passwords is required which may not be feasible
Solution Approach 1:
The patent applies the disposable principle by using a salt value that is discarded after use. The salt is a random value used during the key derivation process to ensure uniqueness and prevent pre-computation attacks. After the derived key is generated, the salt is no longer needed and can be discarded. This allows the system to increase protection strength by using different salts or adjusting parameters without requiring retention of sensitive original password material.
Data Source
AI summary
A computer-implemented method of protecting digital data includes applying a key derivation function to a first value to generate a first derived key, the first value being equal to or derived from a first input password. The first derived key is combined with the digital data to generate a protected record stored in the computer. Subsequently, the key derivation function is applied to a second value to generate a second derived key, the second value being equal to or derived from a second input password. The protected record is processed using the second derived key to permit access to the digital data when the second derived key matches the first derived key. The key derivation function includes iterations of a two-stage hashing operation creating and using an array of memory blocks whose size is specified independently of the number of iterations to decouple processing and memory requirements.