Mobile App Data-at-Rest: PIN-Derived Key vs Offline Brute-Force

What is Data-at-Rest Encryption?

Data-at-rest encryption refers to the process of securing sensitive information stored on a device or server. This ensures that even if an attacker gains physical access to the storage medium, they cannot read the data without proper decryption keys.

In mobile apps, this often involves encrypting user data using a key derived from a PIN entered by the user.

PIN-Derived Key Mechanism

The PIN is used as input to a key-derivation function (KDF) that generates an encryption key. Common KDFs include PBKDF2, scrypt, and Argon2id.

The strength of the derived key depends on both the complexity of the PIN and the parameters of the KDF.

Offline Brute-Force Attack

An offline brute-force attack involves trying every possible combination of the PIN until the correct one is found. The attacker can perform this attack at their leisure, without needing to interact with the device.

The time required for such an attack increases exponentially with the number of possible PIN combinations and the complexity of the KDF.

Trade-Offs Between Unlock Latency and Brute-Force Resistance

Increasing the work factor (the computational effort required to derive the key) can significantly increase the time needed for an attacker to perform a brute-force attack, but it also increases the latency when users unlock their devices.

Balancing these factors is crucial in ensuring both security and usability.

Frequently asked questions

Try it live

Everything above runs in your browser — open Mobile App Data-at-Rest (2D): PIN-Derived Key vs Offline Brute-Force and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.