IronCoreLabs / IronCoreLabs/ironweb

Increase the number of PBKDF2 iterations to match or exceed the OWASP standards

Open
#197 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
13
Forks
2
Avg merge
2d 15h
Merged PRs (30d)
3

Description

The current amount of PBKDF2 iterations is below the OWASP standard of 600,000. We should increase the amount and encode the number of iterations on the front of the encrypted private key.

**Current format (92 bytes):** `[salt(32)][iv(12)][AES-GCM encrypted key(48)]`
**New format (96 bytes):** `[iterations(4, big-endian uint32)][salt(32)][iv(12)][AES-GCM encrypted key(48)]`

We can detect the legacy based on the length and 4 bytes will be plenty to contain any iteration increase over time.

OWASP 2023 recommendation was 600,000, but going to 750,000 seems reasonable to me since that recommendation is a few years old.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.