Examining PBKDF2 security margin - Case study of LUKS

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14330%2F19%3A00107341" target="_blank" >RIV/00216224:14330/19:00107341 - isvavai.cz</a>

Výsledek na webu

<a href="http://dx.doi.org/10.1016/j.jisa.2019.03.016" target="_blank" >http://dx.doi.org/10.1016/j.jisa.2019.03.016</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1016/j.jisa.2019.03.016" target="_blank" >10.1016/j.jisa.2019.03.016</a>

Jazyk výsledku

angličtina

Název v původním jazyce

Examining PBKDF2 security margin - Case study of LUKS

Popis výsledku v původním jazyce

Passwords are widely used to protect our sensitive information or to gain access to specific resources. They should be changed frequently and be strong enough to prevent well-known attacks. Unfortunately, user-chosen passwords are usually short and lack sufficient entropy. A possible solution to these problems is to adopt a Key Derivation Function (KDF) that allows legitimate users to spend a moderate amount of time on key derivation, while imposing CPU/memory-intensive operations on the attacker side. In this paper, we focus on long-term passwords secured by the Password-Based Key Derivation Function 2 (PBKDF2) and present the case study of Linux Unified Key Setup (LUKS), a disk-encryption specification commonly implemented in Linux based operating systems. In particular, we describe how LUKS protects long-term keys by means of iteration counts defined at runtime, and analyze how external factors may affect the iteration counts computation. In doing so, we provide means of evaluating the iteration count values defined at run-time and experimentally show to what level PBKDF2 is still capable of providing sufficient security margin for a LUKS implementation.

Název v anglickém jazyce

Examining PBKDF2 security margin - Case study of LUKS

Popis výsledku anglicky

Passwords are widely used to protect our sensitive information or to gain access to specific resources. They should be changed frequently and be strong enough to prevent well-known attacks. Unfortunately, user-chosen passwords are usually short and lack sufficient entropy. A possible solution to these problems is to adopt a Key Derivation Function (KDF) that allows legitimate users to spend a moderate amount of time on key derivation, while imposing CPU/memory-intensive operations on the attacker side. In this paper, we focus on long-term passwords secured by the Password-Based Key Derivation Function 2 (PBKDF2) and present the case study of Linux Unified Key Setup (LUKS), a disk-encryption specification commonly implemented in Linux based operating systems. In particular, we describe how LUKS protects long-term keys by means of iteration counts defined at runtime, and analyze how external factors may affect the iteration counts computation. In doing so, we provide means of evaluating the iteration count values defined at run-time and experimentally show to what level PBKDF2 is still capable of providing sufficient security margin for a LUKS implementation.

Druh

J_imp - Článek v periodiku v databázi Web of Science

CEP obor

—

OECD FORD obor

10200 - Computer and information sciences

Projekt

<a href="/cs/project/GBP202%2F12%2FG061" target="_blank" >GBP202/12/G061: Centrum excelence - Institut teoretické informatiky (CE-ITI)</a><br>

Návaznosti

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)<br>S - Specificky vyzkum na vysokych skolach

Rok uplatnění

2019

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název periodika

Journal of Information Security and Applications

ISSN

2214-2126

e-ISSN

—

Svazek periodika

46

Číslo periodika v rámci svazku

1

Stát vydavatele periodika

NL - Nizozemsko

Počet stran výsledku

11

Strana od-do

296-306

Kód UT WoS článku

000467422300024

EID výsledku v databázi Scopus

—