Password-based cryptography

Password-based cryptography generally refers to two distinct classes of methods:

  • Single-party methods
  • Multi-party methods

Single party methods

Some systems attempt to derive a cryptographic key directly from a password. However, such practice is generally ill-advised when there is a threat of brute-force attack. Techniques to mitigate such attack include passphrases and iterated (deliberately slow) password-based key derivation functions such as PBKDF2 (RFC 2898).

Multi-party methods

Password-authenticated key agreement systems allow two or more parties that agree on a password (or password-related data) to derive shared keys without exposing the password or keys to network attack. Earlier generations of challenge-response authentication systems have also been used with passwords, but these have generally been subject to eavesdropping and/or brute-force attacks on the password.

gollark: Abigail will complain unless you use anything other than Haskell, probably.
gollark: https://www.npmjs.com/package/ws
gollark: Depends what language you want to use on the serverside.
gollark: I mean, maybe, but you can just use websockets directly on the *server* and skip some hassle.
gollark: It's really not hard to use websockets directly.

See also
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.