Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve KDF handling #527

Open
wants to merge 5 commits into
base: master
Choose a base branch
from
Open

Improve KDF handling #527

wants to merge 5 commits into from

Commits on Sep 1, 2024

  1. Improve argon2 handling and KDF in general 

    Previously it wasn't possible to use argon2 as KDF function without the tomb tools from extras/kdf-keys being available.
To change that behaviour introduce checks on the ARGON2 variable. Additionally add a fallback function to create a salt that is compatible to tomb-kdb-pbkdf2-gensalt.

Options specific for the different supported KDF algorithm are reorganized. Some options align between the various KDF and some are unique to them.
The output of -h is enhanced with the various --kdf options and depends on the available optional tools. argon2 specific cli arguments won't be displayed if argon2 is not available.

Add case for results beside argon2 and pbkdf2. Key creation won't be stopped, just a warning is issued that the resulting key won't be protected via KDF.

Regarding the cli options. The argument for the suboption --kdf is made optional. In that regard one needs to make sure, that if --kdf is the last option before an argument one needs to use - to separate or use -k.
Example: tomb forge --kdf - testkey.tomb
Example: tomb forge --kdf -k testkey.tomb
Example: tomb forge -k testkey.tomb --kdf

Additonally the kdf options are reorganized, which is a possible breaking change for scripts or GUI helpers.
* --kdftype is changed to --kdf
* --kdfiter is introduced as replacement the for previous --kdf definition
* --kdfpar is introduced to support the parallelism option of argon2 (nice to have if someone wants to adjust memory or iteration costs without increasing the time that much)
Only --kdf is mandatory to get a key which is protected with KDF. For every other option safe defaults are set and can be optionally adjusted.
KDF related subcommand options are removed where they don't come into play. gen_key() is only called in forge and passwd.

Closes dyne#526
    @Narrat
    Narrat committed Sep 1, 2024
    Configuration menu
    Copy the full SHA
    d6cdee4 View commit details
    Browse the repository at this point in the history

  2. update man page for recent KDF changes

    @Narrat
    Narrat committed Sep 1, 2024
    Configuration menu
    Copy the full SHA
    25db27b View commit details
    Browse the repository at this point in the history

  3. remove commented code in KDF section 

    The check if the argument of --kdfiter is an integer is unnecessary.
Neither argon2 nor tomb-kdb-pbkdf2-getiter care about float input.
    @Narrat
    Narrat committed Sep 1, 2024
    Configuration menu
    Copy the full SHA
    0fefabc View commit details
    Browse the repository at this point in the history

  4. extras/tests: adjust 30_kdf for KDF related changes

    @Narrat
    Narrat committed Sep 1, 2024
    Configuration menu
    Copy the full SHA
    2337705 View commit details
    Browse the repository at this point in the history

  5. extras/tests: add test for argon2 functionality 

    rename original kdf test accordingly to be pbkdf2 related.
    @Narrat
    Narrat committed Sep 1, 2024
    Configuration menu
    Copy the full SHA
    000c177 View commit details
    Browse the repository at this point in the history