Proper key strengthening makes off-line brute force attacks annoyingly difficult against all except the weakest keys. There is pretty much no way to eliminate an off-line brute force attack: Even if you instead require passwords that attacker could capture the exchange with the server and execute a brute force attack against the session crypto.
Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds