MetaMask / MetaMask/metamask-extension
Increase hash cycles for vault encryption
- Dominant language
- TypeScript
- Stars
- 13.2k
- Forks
- 5.6k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 451
Description
Currently we have [a small-ish number of hash cycles](https://github.com/MetaMask/browser-passworder/blob/ed7a0574f50e66f9bcdb411b1525605a27634242/src/index.ts#L112) (10k) to derive the local encryption key from the user's password. We can pretty easily increase this number of cycles (with a backwards-compatible change to `browser-passworder`), but it will impact performance. We probably are already taking a performance hit from the `SES/lockdown()` we're performing.
To improve performance of unlocking but also increase security of our encrypted local storage, we should:
- [ ] Convert our vault decryption to WebAssembly
- [ ] Increase the number of hash cycles used in our vault encryption/decryption.
Contributor guide
Research direction
Start with src/index.ts at the linked key-derivation code and read how browser-passworder currently handles vault encryption and decryption. Evaluate the two listed goals together, including the stated performance impact of more hash cycles and SES/lockdown(). Done means a backwards-compatible implementation that improves security while addressing vault unlock performance.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript, wasm
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100