MetaMask / MetaMask/metamask-extension

Increase hash cycles for vault encryption

Open
#10,678 0 comments 0 reactions 0 assignees View on GitHub
type-enhancement type-security
Dominant language
TypeScript
Stars
13.2k
Forks
5.6k
Avg merge
2d 5h
Merged PRs (30d)
451

Description

Currently we have [a small-ish number of hash cycles](https://github.com/MetaMask/browser-passworder/blob/ed7a0574f50e66f9bcdb411b1525605a27634242/src/index.ts#L112) (10k) to derive the local encryption key from the user's password. We can pretty easily increase this number of cycles (with a backwards-compatible change to `browser-passworder`), but it will impact performance. We probably are already taking a performance hit from the `SES/lockdown()` we're performing.

To improve performance of unlocking but also increase security of our encrypted local storage, we should:
- [ ] Convert our vault decryption to WebAssembly
- [ ] Increase the number of hash cycles used in our vault encryption/decryption.

Contributor guide

Open the contributing guide

Research direction

Start with src/index.ts at the linked key-derivation code and read how browser-passworder currently handles vault encryption and decryption. Evaluate the two listed goals together, including the stated performance impact of more hash cycles and SES/lockdown(). Done means a backwards-compatible implementation that improves security while addressing vault unlock performance.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript, wasm
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.