Concepts
Key stretching
Making weak passwords costly to guess
How it works
Key stretching runs a password through a deliberately slow (and ideally memory-hungry) function before storing or using it. A legitimate login pays the cost once, but an attacker trying billions of guesses pays it billions of times. PBKDF2, bcrypt, scrypt and Argon2 are key stretching functions.
Strengths
- Makes offline cracking of stolen hashes far slower
- Cost can be raised over time
Weaknesses and known attacks
- Cannot save truly weak or reused passwords
- High settings consume server resources and need rate limiting on logins
Use it for
- Password storage
- Deriving encryption keys from passphrases
Don't use it for
- High-entropy keys, which need a fast KDF such as HKDF instead
Exam tip
Salting defeats rainbow tables; key stretching slows brute force. Exams often list both as separate correct answers.