论文标题
用于快速，灵活，安全和实用密钥管理的多因素密钥推导功能（MFKDF）
Multi-Factor Key Derivation Function (MFKDF) for Fast, Flexible, Secure, & Practical Key Management
论文作者
论文摘要
我们介绍了多因素密钥推导函数（MFKDF）的第一个常规结构。我们的功能扩展了基于密码的密钥推导功能（PBKDF），并支持在密钥推导过程中使用其他流行的身份验证因素，例如TOTP，HOTP和硬件令牌。在此过程中，它为PBKDF提供了指数的安全性改进，在典型的Web浏览器中，少于12毫秒的其他计算开销。我们进一步提出了MFKDF的阈值，如果丢失了一个因素，则可以进行客户端的密钥恢复和重建。最后，通过“堆叠”派生的键，我们提供了一种密码执行任意特定特定的键推导策略的手段。结果是使用所有可用的身份验证因素朝着对用户数据的直接加密保护进行范式转变，而用户体验没有明显的变化。我们证明了解决方案的能力，不仅可以显着提高实施PBKDF的现有系统的安全性，而且还可以启用新的应用程序，即PBKDF不会被视为可行的方法。
We present the first general construction of a Multi-Factor Key Derivation Function (MFKDF). Our function expands upon password-based key derivation functions (PBKDFs) with support for using other popular authentication factors like TOTP, HOTP, and hardware tokens in the key derivation process. In doing so, it provides an exponential security improvement over PBKDFs with less than 12 ms of additional computational overhead in a typical web browser. We further present a threshold MFKDF construction, allowing for client-side key recovery and reconstitution if a factor is lost. Finally, by "stacking" derived keys, we provide a means of cryptographically enforcing arbitrarily specific key derivation policies. The result is a paradigm shift toward direct cryptographic protection of user data using all available authentication factors, with no noticeable change to the user experience. We demonstrate the ability of our solution to not only significantly improve the security of existing systems implementing PBKDFs, but also to enable new applications where PBKDFs would not be considered a feasible approach.
