I've just released a python keyring companion package to encrypt the passwords in a file, available here.


The project is mainly targeted to provide a sufficiently secure storage for plain text passwords (keyring) in a simple portable file, where the default keyring storage implementation of a desktop environment doesn't fit.


The keyring is secured with a keyring password. A raw Argon2(\$argon2id\$v=19\$m=65536,t=15,p=2) hash is generated from the keyring password, which is used as a key for AES encryption of plaintext passwords in OCB mode. The resulting encrypted data is persisted, together with the Argon2 salt, the OCB nonce and the OCB MAC. This value is stored with service/userid reference in a text file (.ini format).

Initially, a static reference value, treated as a plaintext password is stored as well, and this values is used for verification of the keyring password in subsequent accesses.

Attack surface

The static reference value might allow some form of attack, as it encrypts a well known value. Hopefully, the Argon2 hash, combined with the AES encryption raises the effort to break the key sufficiently high.


Is this approach sufficient for establishing privacy of the secured data?

  • 1
    $\begingroup$ Welcome to crypto-SE. Unfortunately, your question is off-topic on this site, see the information about on-topic questions in the help center. Programming questions in general are considered a better fit for Stack Overflow. However, I am not aware of any platform, which specilizes on cryptographic implementations. From a first glance, the most difficult aspect is probably a proper key management (what you call key ring). $\endgroup$
    – tylo
    Mar 10 '17 at 12:04
  • $\begingroup$ Do you authenticate the public data in the .ini file as well? BTW, you may also find this PDF interesting. $\endgroup$
    – SEJPM
    Mar 10 '17 at 15:34
  • $\begingroup$ Hey SEJPM and tylo, thank you very much for your feedback. Hopefully the rewrite is more on track. The public data is not authenticated. The PDF is very interesting. Funnily, here's what I've written (2nd block, 3nd paragraph) 3 hours ago ;) $\endgroup$
    – frispete
    Mar 10 '17 at 16:06
  • $\begingroup$ I've switched to GCM by default, allow any AEAD mode out of CCM, EAX, GCM, OCB, and authenticate the service and username values via associated data. Authenticating the number of entries will have to wait for tomorrow. Guess, It's better to start a new question with the current state, given, that even the headline is insufficient now. If I read the supplied PDF correctly, these changes will make this little project stronger than any project described in this paper. :hehe: $\endgroup$
    – frispete
    Mar 14 '17 at 0:52
  • $\begingroup$ @SEJPM, thanks again for pointing me to the password manager security paper. Unfortunately, no matter how often I read the description of the IND-CDBA game, I don't understand the attack logic? $\endgroup$
    – frispete
    Mar 22 '17 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.