# Login security and plaintext of a password stored in Argon2i to derive a key via halite safe?

I'm using Symfony 4. I have set parameters on all my Argon2 stuff below so that it takes 1s per iteration. This website is supposed to encrypt HIPAA information.

Basically I have a table like this

username varchar(50),


In the password field I'm storing passwords with Argon2i. Users login and it verifies their password in the database (this is all done with Symfony login). After that users are presented with another screen to enter a passphrase. They enter the second password (this password is shared among all employees of the company).

I have another table like

key_pass varchar(255),
salt varchar(50)


the second password is used with password_verify against the value of key_pass which is a password stored with Argon2i. If it's successful, then I use Halite (aka scrypt provided by libsodium in this scenario) to derive a key using the value of salt. Basically the whole thing looks like this:

if (password_verify($$view->getPassword(),$$encryption->getKeyPass())) {
$$encryption_key = EncryptionKey::deriveFromPassword($$view->getPassword(),
\$encryption->getSalt()
);
}


This key would be used to decrypt the rest of the data in the db.

So three questions:

1) Is this form of double authentication even helping security? I mean basically in the end if the attacker gets the second passphrase they don't even need the first login (assuming they have direct access to the data). I suppose it just makes the web site more secure since they can't even attack the second passphrase without having the first via the web site?

2) Is using the second passphrase to derive the key safe?

3) Assuming #2 is "yes", in the event I want to change the second passphrase (i.e. - employee leaves company), is this possible without re-encrypting all of the data using the new derived key? If no, what possible implementations/alternatives could allow for that? Perhaps storing another key encrypted in the database and using the above derived key to decrypt that and then that key is the real key that decrypts other data in the db? If that works would Halites Symmetric::encrypt be secure enough for the second key?

Thanks for any help! I've been researching this stuff for months but I'm no security expert - would REALLY appreciate somebody just validating all this that I came up with

• Could you mention about possible attack scenarios? For example; database only, application server only (limited or long time), client promise ( via a key logger etc.). – kelalaka Sep 29 '18 at 14:53

1. Is this form of double authentication even helping security?

Possibly, but in general, asking users to remember two passphrases is asking too much. It is less likely that either one of them will be secure enough to be used as password.

2. Is using the second passphrase to derive the key safe?

Probably, but sharing a password among all the other employees is certainly not secure.

Besides that, using both Argon2i and scrypt on the same input material only slows down your service, while an adversary only needs to perform the fastest one (from their perspective).

If a key is derived after verification of the password then a Key Based KDF such as HKDF can be used.

3. ... is this possible without re-encrypting all of the data using the new derived key?

No, for that you'd need a data key as you're describing.

If that works would Halites Symmetric::encrypt be secure enough for the second key?

Sorry, but that's off topic here; we cannot vouch for the security of a crypto system or library. You can of course do worse than libsodium to encrypt data, but if it is secure also depends on system and implementation details.

• Interesting! The second password was also to ensure that the key was not kept anywhere on the system though, is there something I could use instead so that I don't have to keep the key somewhere on the server? Something that could share a key between their passwords or something? Would HKDF do that? – Element Zero Oct 3 '18 at 3:23
• You could encrypt it with each of the users passwords. HKDF can be used together with a label to derive different values from the password hash: one for authentication, one for encryption (wrapping) of the data key. The problem with key management is that there are many possibilities and there is no algorithm to calculate which one is best: it depends on the system configuration. – Maarten Bodewes Oct 3 '18 at 20:32