Is using AES GCM with PBKDF2 and 100 000 iterations still considered secure as of 2022?
In our threat model, if we ignore the risks linked to quantum computing, is this secure?
Here is an example working Python implementation:
import Crypto.Random, Crypto.Protocol.KDF, Crypto.Cipher.AES
plaintext = b"hello world hello world hello world hello world hello world"
password = b"correct horse battery staple"
nonce = Crypto.Random.new().read(16)
key = Crypto.Protocol.KDF.PBKDF2(password, nonce, count=100000)
cipher = Crypto.Cipher.AES.new(key, Crypto.Cipher.AES.MODE_GCM, nonce=nonce, mac_len=16)
ciphertext = (nonce,) + cipher.encrypt_and_digest(plaintext) # nonce | ciphertext | tag
print(ciphertext)
Note: using the same nonce
for PBKDF2
and AES.new(...)
seems not to be a problem if we never re-use this nonce
for future encryptions, see Reusing PBKDF2 salt for AES/GCM as IV: dangerous?
a-zA-Z0-9
). Does 100k iterations of PBKDF2 make it out of reach of attackers nowadays? PS: I think your last comment can be turned into the answer. $\endgroup$