1
$\begingroup$

I'm implementing encryption in my browser extension that will allow users to encrypt their data and then share them with others. And since shared links can be leaked, I want to protect the data as much as possible against brute force attacks.

I'm using PBKDF2 to derive 256 bits:

self.crypto.subtle.deriveBits({name, salt: new Uint8Array(salt), iterations, hash}, keyMaterial, 256)

I wanted to use SHA-512 to make algorithm harder (also for GPU) but it looks like it makes it also much harder for browsers, especially Firefox where I can do 6 times more iterations in the same time:

Firefox 118:
Hashing with: PBKDF2, SHA-512, 1,000,000  time: 819
Hashing with: PBKDF2, SHA-256, 6,000,000  time: 837

Chrome 119:
Hashing with: PBKDF2, SHA-512, 1,000,000  time: 307
Hashing with: PBKDF2, SHA-256, 6,000,000  time: 532

The question is:

  • should I stick with SHA-256 and more iterations?
  • should I use Argon2 instead? (but browsers doesn't support it so I would have to bundle the library which uses WASM which slightly complicates things for extensions).
  • or it doesn't matter and I should force users to set longer passwords instead?
Improve this question
$\endgroup$
2
  • $\begingroup$ The typical recommendation is to only use PBKDF2 if you must and instead use a newer password-based KDF if possible. However, various password managers still use PBKDF2 due to issues using Argon2 in JavaScript/browsers, although some are moving over. SHA-512 should be favoured because it requires fewer iterations. Strong passwords cannot be guaranteed. $\endgroup$
    – samuel-lucas6
    Sep 20 at 18:22
  • $\begingroup$ Scrypt exist in JS, that it better than PBKDF2 since it has memory hardness. The general consensus is using 1s per generation. Keep in mind that, it may need 1s in your browser, however, it may be less some other system, even more the attacker doesn't need to obey your rules. You should define the attacks and risk then calculate the timing to bruteforce. At least, you may use some services that test passwords against the broken ones apart from your password policy. $\endgroup$
    – kelalaka
    Sep 21 at 10:20

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.