If your (binary, derived 128 bit) encryption key is the key your treasure chest - then the "derivation" is a map from your password ("hunter2") to the where the

If your (binary, derived 128 bit) encryption key is the key your treasure chest - then the "derivation" is a map from your password ("hunter2") to the where the key (011101...) is buried. With plain derivation, the map takes you directly from the password to the key. With an extra iteration, the map just points to a place on the map where a trail starts. If you want to guess the key, by guessing the password - now you have to first walk to were the password points on the map, then follow the path (the iterations) - then dig and see if the key is there. Then you can try the key in the chest (the encrypted data). The iterations (length of path) adds a certain, predictable, amount of work in order to find the key. It does not make it harder to guess the password, just harder to get the key from the password - and so it makes it harder to check if you've guessed the right password (try the key in the lock) - because there's extra work to be done. Now you could compare memory-hard paths and compute-hard paths by adding elevation and distance to the analogy (different types of hard work).