1
$\begingroup$

I just read this blog post (Signal - Technology Preview for secure value recovery) by Signal and something is not quite clear to me. In section "Stretching beyond a KDF" they generate a stretched_key on the client side using stretched_key = Argon2(passphrase=user_passphrase, output_length=32). Argon2 needs a salt and other parameters (iterations, parallelism, etc.) as far as I know.

Now my question is: How do they store this salt (and Argon2 parameters)? Since a user could delete the app and later want to login again, it has to be stored on the server or the salt and parameters need to be the same for all users. If it is indeed stored on the server, how do they protect it? Or is it sufficient for "key stretching" purposes to use the same salt and parameters for all users?

Hope somebody can help me out here. Cheers!

| improve this question | |
$\endgroup$
  • $\begingroup$ I assume the other parameters are omitted for the sake of brevity. And that it's implied that they're really some reasonable values in practice. $\endgroup$ – Future Security Apr 7 at 23:26
  • $\begingroup$ Yea that's certainly possible, but I'm wondering how they could possibly have solved this? Because they need to keep those parameters somewhere without user authentication on the server. Would it be enough for them to just let users download the salt and argon2 parameters from an unprotected API endpoint? Or they indeed use just the same params and the same salt for every "key stretching" operation, because it's not possible to offline brute force this key anyway $\endgroup$ – user2403221 Apr 8 at 10:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.