# Tag Info

Your $k_2$ value is functioning effectively the same way as conventional password verification methods, where you store a salted password hash of the users' passwords. So it allows for an adversary to test password guesses, but— So does the authenticated GCM $(c, tag)$ pair; The memory hard scrypt function is your main line of defense against this attack ...
You can use a similar method like VeraCrypt. Also, you can use a better Key derivation alternative like Argon2id. Argon2id is the combined version of Argon2d, data-dependent, and Argon2i data-independent modes. For the encryption Get/force a good password from user and use it with Argonid with application/usage dependent domain separation k = \...