Can key hardening compensate lack of entropy? In the context of an offline brute-force attack on encrypted data at rest (say, a password-protected AES encrypted file), is a password with 64 bits of entropy and 65536 rounds of key hardening just as strong as a password with 80 bits of "true" entropy (and no key hardening)?  I guess what I really want to know is, can I get away with using a shorter password if I know that key hardening is applied?
Yes. That's the entire idea of key stretching, you can get away with a password that offers less strength against attacks. You add more operations to a brute force/dictionary attack to protect the keys. The disadvantage is that you need to do the same number of operations during key derivation.

Passwords commonly don't have 64 bits or 80 bits of entropy though. Say that the alphabet is 64 characters (6 bits) then you'd need a fully random password of 11 characters. For 80 bits you'd already need 14 characters. Those are easy to generate of course, but it may be tricky to remember them. And if you have to revert to a password manager, you might as well use a password that requires a few more keystrokes.

Note that shorter doesn't necessarily mean less strength. A password of 12 zero digits is not very strong. And although the idea behind "correct horse battery staple" is great, the strength of the passphrase is of course not the same as 28 fully random characters.



J.D. indicates that, indeed, different operations are performed for a single round. The amount of operations however will stay the same, so the increase should be in the same ball park. You could possibly assign a weight to each round of AES vs each round of the key strengthening routine to get a better estimate about the increase of strength.