How to securely encrypt a file with an insecure password in Rust

Re:How to securely encrypt a file with an insecure password ... by tyingq on Wednesday January 19, 2022 @01:08PM (#29997525)

It does seem like talking about dictionary attacks in the article would be helpful. Without some reference as to how many argon2 hashes per minute is reasonably possible with the shown settings, we're flying a little blind.

[ Parent | on HN ]

Re:How to securely encrypt a file with an insecure password ... by woodruffw on Wednesday January 19, 2022 @01:22PM (#29997748)

I performed a rough estimate in my comment up the thread, using ~2s per Argon2id with a time cost of 3. TL;DR is that you probably wouldn't want to have an extremely common password with this scheme.

[ Parent | on HN ]

Re:How to securely encrypt a file with an insecure password ... by stouset on Wednesday January 19, 2022 @02:40PM (#29998886)

There's no KDF in the world that can protect you if your password is in a top-10,000 list or exposed elsewhere alongside your username.

[ Parent | on HN ]

Re:How to securely encrypt a file with an insecure password ... by tyingq on Wednesday January 19, 2022 @02:48PM (#29999012)

Right, but that's sort of what I was getting at. The article doesn't talk much about the password other than it's "insecure". It's probably worth mentioning that a dictionary attack at some multiple of ~2/per-second/per-core is possible. So it's not just top-10,000 list, but maybe "top million" or more that's a bad idea.

[ Parent | on HN ]

Re:How to securely encrypt a file with an insecure password ... by woodruffw on Wednesday January 19, 2022 @04:00PM (#30000036)

Yes, I think that's what the GP was trying to say. The post doesn't qualify "insecure" meaning "not best practices" vs. "insecure" meaning "your password is an extremely common one."

[ Parent | on HN ]