Use scrypt for key generation in config file encryption
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 59.8k
- Forks
- 5.4k
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 48
Description
Currently the key generation from the user's password is done with sha256 for the config file. It has pre and post strings so isn't vulnerable to rainbow table attack, but using sha isn't best practice any more as it isn't computationally expensive enough.
We should upgrade to using scrypt with salt we store in the encrypted config file (or maybe reuse the IV for the secret box encryption). This can be done transparently to the user. We'll need to continue to read the old format though.
Also document the format
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate the config-file encryption entry points and the current password-to-key generation and format handling. Review how encrypted configurations are read and written, then define compatibility for the old format, the new scrypt salt storage, and the requested format documentation; verify both formats with the existing tests if available.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100