Suppose I have a password, in which I use Argon2ID with 1GB memory to derive an encryption key. Then, I encrypt my data using XChaCha20 using that encryption key. The problem with ChaCha is that any encryption key "works". If you use the wrong password to decrypt, you won't get an empty output or error like AES, but instead, you just get corrupted/useless data. I want to be able to validate the password so that I know whether it is correct before decrypting. If I take the SHA3_512 of the Argon2ID-ed password and include it with the ciphertext, is the ciphertext now vulnerable to attacks? I'm using a CSPRNG to generate Argon2ID's salt and ChaCha's nonce, which would put off rainbow tables. Is this scheme secure? Here's a visual example:

plaintext = "sfsdfasdfadfasdfasdfasdfadf"
password = "some_very_strong_password_blah"
salt = csprng(16)
nonce = csprng(24)
key = argon2id(password,salt,t=32,m=1GB,p=4)
ciphertext = XChaCha20.encrypt(plaintext,password,nonce=nonce)
check = sha3_512(key)
ciphertext += check
// Done. To check the password,
// I would derive the key using Argon2ID
// again and compare it with 'check'

Would this be secure? I know about this question, but that scenario is without a KDF and doesn't include any entropy. Thanks.

Update: AES does not give an empty output if the wrong key is used. The crypto library I use does.


You don't get empty output in AES, too. AES is a permutation and will always return a plaintext, correct or not depending on the key.

If I take the SHA3_512 of the Argon2ID-ed password and include it with the ciphertext, is the ciphertext now vulnerable to attacks?

One needs to find a pre-image to the key, and normally the cost of this is around $2^{512}$ for SHA3-512, however, if you are using xChaCha20 then the cost is around $2^{256}$ since the input is the 256-bit key. In any case, it is secure to be bruteforced.

You can also, encrypt the all-zero message block or any random message block you chose to validate the key.

Note that the Veracrypt uses Decryption is considered successful if the first 4 bytes of the decrypted data contain the ASCII string “VERA”

Is this scheme secure?

First of all, your password's strength is important. You should either use dicewire to have strong passwords or use a password manager to generate one, and those still require a master strong password from you.

The missing part is the integrity of the data, you can use Poly1305 together with the xChaCha20 to have the confidentiality, integrity, and authentication, too.

Another issue can be the update of the encrypted data. If you use the same $(Key, nonce)$ pair for the update, the updated parts of the file are vulnerable to crib-dragging and that part may fail the confidentiality. To mitigate this, you need either use a new $nonce$ and encrypt all of the message or use a new key, too.

A side note; you can use this strong password to derive multiple keys directly with Argon2id or use HKDF's expand part since the derived key from Argon2id is already is a Pseudo-Random Key.

  • 1
    $\begingroup$ Oh, right. AES always gives an output. The library I use just returns an empty string, so I mixed things up. I'll edit my post to make it more clear. Thanks for the great answer! $\endgroup$
    – Evan Su
    Feb 15 '21 at 20:47
  • $\begingroup$ Okay, no problem. $\endgroup$
    – Evan Su
    Feb 15 '21 at 20:48
  • 1
    $\begingroup$ Just a side note, I am using Poly1305 along with ChaCha. The reason I asked this question is because Poly1305 will tell me the integrity of the file, but it can't distinguish between an incorrect key and corrupt data. Using the scheme above, I can now tell an incorrect key apart from corrupt/modified data. $\endgroup$
    – Evan Su
    Feb 15 '21 at 20:55
  • 1
    $\begingroup$ Nice, For you, I've added VeraCrypt's approach, too. $\endgroup$
    – kelalaka
    Feb 15 '21 at 21:05
  • $\begingroup$ Just curious about something. If I use sha3_512 and Whirlpool together, does it increase the overall security of this setup? An attacker is obviously not going to bruteforce the Argon2ID, so the best attack surface would be the sha3_512 hash. If I'm very paranoid about security, would cascading hash algorithms increase the cost of bruteforce and therefore security? Or is 2^256 too large for it to have an significant impact? $\endgroup$
    – Evan Su
    Feb 16 '21 at 0:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.