How to securely encrypt a file with an insecure password in Rust

Re:How to securely encrypt a file with an insecure password ... by woodruffw on Wednesday January 19, 2022 @01:22PM (#29997748)

I performed a rough estimate in my comment up the thread, using ~2s per Argon2id with a time cost of 3. TL;DR is that you probably wouldn't want to have an extremely common password with this scheme.

[ Parent | on HN ]

Re:How to securely encrypt a file with an insecure password ... by stouset on Wednesday January 19, 2022 @02:40PM (#29998886)

There's no KDF in the world that can protect you if your password is in a top-10,000 list or exposed elsewhere alongside your username.

[ Parent | on HN ]

Re:How to securely encrypt a file with an insecure password ... by tyingq on Wednesday January 19, 2022 @02:48PM (#29999012)

Right, but that's sort of what I was getting at. The article doesn't talk much about the password other than it's "insecure". It's probably worth mentioning that a dictionary attack at some multiple of ~2/per-second/per-core is possible. So it's not just top-10,000 list, but maybe "top million" or more that's a bad idea.

[ Parent | on HN ]

Re:How to securely encrypt a file with an insecure password ... by woodruffw on Wednesday January 19, 2022 @04:00PM (#30000036)

Yes, I think that's what the GP was trying to say. The post doesn't qualify "insecure" meaning "not best practices" vs. "insecure" meaning "your password is an extremely common one."

[ Parent | on HN ]