In order to implement a plaintext password file safe (keyring), while adhering to best Crypto practices today, I came up with this scheme:
- A user's master password is hashed with Argon2 (\$argon2id\$v=19\$m=65536,t=15,p=2)
- Hash is used as key for encrypting auxiliary plain text passwords with AES 128 GCM
- The public plaintext password values (called service and username) are authenticated (providing them as associated data for GCM)
The resulting data structure looks like this
(for breverity, the base64 encoded json value is decoded here):
[service]
username = {"nonce": "CusUx2wp0pHzPAqEaRsKAw==",
"mac": "kStM+2I4+L5Jy3fl13BVYQ==",
"data": "UK9Txr4aEY1Yd1FQKApbpK2aFzdbKLCfgffF",
"salt": "1ACl3k9CWQ9sXKdqVAQlew=="}
Questions:
Somebody suggested to additionally authenticate nonce and salt? Does this make sense, since all values together constitute the input for a successful decryption anyway? (nonce is the GCM nonce, mac the GCM MAC, data the encrypted payload, salt is used for Argon2, mac contains service and username as associated public data)
In my humble believe, this adheres to todays best practices already. Am I missing something?
What are the downsides of NOT authenticating the number of records? For now, I like the fact, that these files can be edited manually (e.g. records can be added and removed, since each record is still tamper resistent in itself). Am I missing something?