I don't understand how KeePass key derivation increases the security of the password db at all. First I'll try to explain what I understood from the key derivation described here. I'll use some pseudo code:
const WORKFACTOR = 6000;
var userKey = UserEnteresPassword();
var userKeyHash = SHA256(userKey);
var randomKey = GetStoredSecureRandomKey();
var tmpKey = userKeyHash;
for(i = 0; i < WORKFACTOR; i++)
tmpKey = AES(tmpKey, randomKey);
var finalKey = SHA256(tmpKey);
Then it uses the final
finalKey to encrpt the password database. This is then stored on the hard drive.
If I now want to decrypt the password database, why would I have to use this key derivation function? I could simply directly guess the
finalKey instead of guessing
userKey and having it run though this function. So I would save all the time I would othwise need for this key derivation function.
I am aware that, if I simply guess the
finalKey I won't be able to get
userKey, but I won't need that since I already have
finalKey, I can simply decrypt the password db with. I am not interested in
userKey at all.
Or is this completly about dictionary attacks to prevent an attack from using commly known words/passwords and simply see if the db decrypts?