1
$\begingroup$

Consider Argon2i used as a key derivation function (implemented by the libsodium crypto library) to derive an encryption key from a password.

Additionally, when entering the password a second time, it should be checked for validity, meaning whether the same encryption key was derived as for the first time.

A possible approach would be:

During key generation:

  1. Derive a 256-bit key from the initial password using Argon2i
  2. Invoke Argon2i a second time using the output of the first "round" as its input
  3. Save the result of the second "round" to persistent storage
  4. Use the result of the first round for encryption

During key regeneration / verification:

  1. Perform steps 1./2. above for the re-entered password
  2. Check the result of the second round against what was previously saved to persistent storage
  3. Use the result of the first round for decryption

Is this approach "safe" when for each invocation of Argon2i the same parameters, but different salts are used? Could there be unintended side effects when chaining Argon2i invocations together? Is it safe to assume that it is impossible to compute the result of the first round given only the result of the second round and all salts? Can the approach be safely extended to use even more rounds?

|improve this question
$\endgroup$
  • $\begingroup$ Yes, Argon2(i) is pre-image resistant. If you want to, you can extend to more rounds, but I fail to see why an attacker would have to execute them given then he could just check whether the encryption key obtained after round #1 works? $\endgroup$ – SEJPM♦ Oct 7 '16 at 19:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.