Suppose I have a password, in which I use Argon2ID with 1GB memory to derive an encryption key. Then, I encrypt my data using XChaCha20 using that encryption key. The problem with ChaCha is that any encryption key "works". If you use the wrong password to decrypt, you won't get an empty output or error like AES, but instead, you just get corrupted/useless data. I want to be able to validate the password so that I know whether it is correct before decrypting. If I take the SHA3_512 of the Argon2ID-ed password and include it with the ciphertext, is the ciphertext now vulnerable to attacks? I'm using a CSPRNG to generate Argon2ID's salt and ChaCha's nonce, which would put off rainbow tables. Is this scheme secure? Here's a visual example:
plaintext = "sfsdfasdfadfasdfasdfasdfadf" password = "some_very_strong_password_blah" salt = csprng(16) nonce = csprng(24) key = argon2id(password,salt,t=32,m=1GB,p=4) ciphertext = XChaCha20.encrypt(plaintext,password,nonce=nonce) check = sha3_512(key) ciphertext += check // Done. To check the password, // I would derive the key using Argon2ID // again and compare it with 'check'
Would this be secure? I know about this question, but that scenario is without a KDF and doesn't include any entropy. Thanks.
Update: AES does not give an empty output if the wrong key is used. The crypto library I use does.