Simple Password-Hardened Encryption Services
summary
A concrete password-hardened encryption (PHE) service uses an external crypto server / rate limiter that stores only PRF shares so a compromised service cannot perform offline dictionary attacks or decrypt data alone. It builds on a key-homomorphic PRF in a DDH group, masks salted hashes with PRF shares, stores an AES data key encrypted under a PRF-derived value, supports proactive key rotation, and runs >525 encrypt/decrypts per second per core while reporting 30–50% efficiency gain over prior schemes.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:12Simple Password Hardened Encryption
- 0:25What's Password Hardened Encryption
- 2:00Practicality
- 2:28Technical Details
- 7:11Key Rotation
- 10:39Obliviousness
related talks
29mPhoenix: Rebirth of a Cryptographic Password-Hardening Service
48mAdvanced Symmetric-Key Encryption
47mPractical Security Foundations
19mPSSH, or the Primordial Soup of Secure Headers
42mPassword Hashing
27mKeeping passwords safe in 2017
15mEncryption at Rest – Master Key Based on a Hybrid KEM
35mHardware Cryptographic Modules