Password Based Encryption with RFC 2898
by
Ryan Dearing
Boise State University

Passwords have become extremely common in daily life, and are often used to create encryption keys. Unfortunately passwords are usually derived from a relatively small space. When using passwords to create encryption keys it is important to make the key resistant to common attacks, especially lookup tables (dictionary attack) and brute force. RFC 2898 describes a set of techniques for creating strong encryption keys based on passwords. The methods described in RFC 2898 use salts to prevent dictionary attacks and iterations to add computational complexity. The effectiveness of these techniques will be discussed analyzed. Code that implements these techniques will also be provided.

Date received: November 17, 2009