I'm a dev new to security and cryptography.
I'm writing a password manager and Time-based OTP combo in dart/flutter to use in multiple devices and platform for fun and use it personally for real. I have done some reading over google, stackoverflow.com and crypto.stackexchange.com, came up with following skeleton, and here to ask for some further security advice, for encryption, implementation and software engineering.
Similar to bit warden, the AES/CBC 256 with PKCS7 padding and shared master password with Argon2 ID KDF is used to encrypt the whole DB, each password and TOTP secrets, all with randomly generated salts and IVs.
- various sources said IV and salt should be randomly generated each time when re-encrypt, and IV stored along with encrypted data.
- How about the salt?
- Is it secure to pack both salt and IV with the encrypted database? Honestly, I can't think of other way to transfer all three of them separately for now.
- while I shuffle or reverse the encryption parameters a bit before applying them, some answers here tell me that it does not improve security. May I know why?
- on S3 storage, the whole DB is encrypted with above algorithm
- when app is started, the whole DB is partially decrypted, thus leaving username and website as plain text on disk
- when user retrieve passwords or request TOPT code, the password or the TOTP secret will be decrypted and display, not stored to disk
- when app is closed or put to background, the partially decrypted DB is deleted from disk
- when app is brought up again, start from step 2 again
- is it secure enough to store Time based OTP secrets and login credentials two separate DB but open with same app?
For portability, I chose the pure dart pointy castle for encryption and decryption.
I run tests on my mobile with other libraries and didn't see it attempts to connect with outside world.
- other than "connecting to outside world" unintended, correctness of algorithm implementation, and trustworthiness (a.k.a. popularity) of libraries, what else should I be aware of?