Android and iOS

Choosing cost for password-based key derivation

Key lifecycles, signatures, encryption and application data.

Keys and cryptography1 min readEditorial methods

User passwords have different entropy from random keys. Derivation needs an appropriate method and parameters that increase guessing cost.

Evaluation approach

Follow current guidance for the chosen method. Balance device performance with offline attack risk and use suitable per-record salts.

Application example

A local vault should consider both low-end-device opening time and an attacker's ability to guess offline.

Limits and considerations

One fast hash is insufficient password-based key derivation.

What happens when costs change?

Store method and cost information with records. Migrate through an appropriate verified path and avoid leaving old parameters as indefinite defaults for new data.

Checks and decisions

  • Choose a suitable method
  • Measure parameters
  • Manage salts correctly

Sources

The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.