Is using AES GCM with PBKDF2 and 100 000 iterations still considered secure as of 2022?
In our threat model, if we ignore the risks linked to quantum computing, is this secure?
Here is an example working Python implementation:
import Crypto.Random, Crypto.Protocol.KDF, Crypto.Cipher.AES plaintext = b"hello world hello world hello world hello world hello world" password = b"correct horse battery staple" nonce = Crypto.Random.new().read(16) key = Crypto.Protocol.KDF.PBKDF2(password, nonce, count=100000) cipher = Crypto.Cipher.AES.new(key, Crypto.Cipher.AES.MODE_GCM, nonce=nonce, mac_len=16) ciphertext = (nonce,) + cipher.encrypt_and_digest(plaintext) # nonce | ciphertext | tag print(ciphertext)
Note: using the same
AES.new(...) seems not to be a problem if we never re-use this
nonce for future encryptions, see Reusing PBKDF2 salt for AES/GCM as IV: dangerous?