# AES OCB with Argon2 KDF for keyring file encryption

I've just released a python keyring companion package to encrypt the passwords in a file, available here.

## Description

The project is mainly targeted to provide a sufficiently secure storage for plain text passwords (keyring) in a simple portable file, where the default keyring storage implementation of a desktop environment doesn't fit.

## Cryptography

The keyring is secured with a keyring password. A raw Argon2(\$argon2id\$v=19\\$m=65536,t=15,p=2) hash is generated from the keyring password, which is used as a key for AES encryption of plaintext passwords in OCB mode. The resulting encrypted data is persisted, together with the Argon2 salt, the OCB nonce and the OCB MAC. This value is stored with service/userid reference in a text file (.ini format).

Initially, a static reference value, treated as a plaintext password is stored as well, and this values is used for verification of the keyring password in subsequent accesses.

## Attack surface

The static reference value might allow some form of attack, as it encrypts a well known value. Hopefully, the Argon2 hash, combined with the AES encryption raises the effort to break the key sufficiently high.

## Conclusion

Is this approach sufficient for establishing privacy of the secured data?

• Welcome to crypto-SE. Unfortunately, your question is off-topic on this site, see the information about on-topic questions in the help center. Programming questions in general are considered a better fit for Stack Overflow. However, I am not aware of any platform, which specilizes on cryptographic implementations. From a first glance, the most difficult aspect is probably a proper key management (what you call key ring). – tylo Mar 10 '17 at 12:04
• Do you authenticate the public data in the .ini file as well? BTW, you may also find this PDF interesting. – SEJPM Mar 10 '17 at 15:34
• Hey SEJPM and tylo, thank you very much for your feedback. Hopefully the rewrite is more on track. The public data is not authenticated. The PDF is very interesting. Funnily, here's what I've written (2nd block, 3nd paragraph) 3 hours ago ;) – frispete Mar 10 '17 at 16:06
• I've switched to GCM by default, allow any AEAD mode out of CCM, EAX, GCM, OCB, and authenticate the service and username values via associated data. Authenticating the number of entries will have to wait for tomorrow. Guess, It's better to start a new question with the current state, given, that even the headline is insufficient now. If I read the supplied PDF correctly, these changes will make this little project stronger than any project described in this paper. :hehe: – frispete Mar 14 '17 at 0:52
• @SEJPM, thanks again for pointing me to the password manager security paper. Unfortunately, no matter how often I read the description of the IND-CDBA game, I don't understand the attack logic? – frispete Mar 22 '17 at 11:07