Suppose one has a password manager, based on symmetric cryptography, that requires a master passphrase to be unlocked. Argon2 is used for deriving a secret key from the master passphrase.
I need several secret keys to encrypt different components, so I'm faced with a choice:
Output more material using Argon2. For example, If I need four secret keys, tell Argon2 to output $4 \cdot 32 \cdot 8 = 1024$ bits, and then split this output into four secret keys.
Create only a master secret key with Argon2 and use the master key to encrypt several other randomly generated secret keys.
What are the different implications of using one option versus the other?
Also, what is the maximum number of bits that it is safe to derive from a master passphrase using Argon2?
What are the different keys for?
Each entry in the main content of the encrypted database is a key-value pair, where the key is, e.g., the address of a Web site, and its associated value is the password for the user's account on the Web site.
A requirement for the assignment (it's a bit artificial, but whatever) is to enable fast access to the password given its key (as in key-value), even when there are many key-value entries. The solution I thought of is to encrypt each entry separately and use an auxiliary encrypted data structure that would map a key (as in key-value) to its entry in sub-linear time. A hash-table approach would perhaps be the best, but more complicated, so I decided I could use a sorted partially encrypted data structure to enable binary search.
Thus, I need a single secret key for AEAD of the main content, and three more keys for the auxiliary sorted data structure that enables faster access to the main content via binary search: the auxiliary structure is composed of two-element entries like so:
- a MAC tag of the key (as in key-value) of the corresponding entry in the main content
- the AEAD-encrypted index of the corresponding entry in the main content
Both entries are authenticated together using AEAD. So that's why I need the second and third key: for the unencrypted MAC tag and for the AEAD-encrypted index.
The auxiliary structure's entries are sorted by first element every time I add to the database or remove from it. Thus binary search over the entries by the first element enable $O(log n)$-time access to the database when just reading it, in the fast-path, when the database's integrity is preserved.
The fourth key is used for creating a MAC tag that authenticates all the AEAD MAC tags of the second element of all auxiliary data structure elements together. I also intend to pass the total number of entries as AEAD associated data.