What would you do if you needed to change the master password? You would need to re-encrypt the entire vault, in addition to limiting the unlocking methods.
The vault should be encrypted using a vault key (VEK, 256 bits) generated once, upon creation. You then derive a key from the master password that will be used only to encrypt the VEK, and for each password entry you save, you derive a new key from the VEK to encrypt it. This way, changing the master password becomes O(1), and you can support multiple forms of authentication for the same vault.
I also strongly recommend replacing AES with XCHacha20 + Poly1305.
Comments 2
What would you do if you needed to change the master password? You would need to re-encrypt the entire vault, in addition to limiting the unlocking methods.
The vault should be encrypted using a vault key (VEK, 256 bits) generated once, upon creation. You then derive a key from the master password that will be used only to encrypt the VEK, and for each password entry you save, you derive a new key from the VEK to encrypt it. This way, changing the master password becomes O(1), and you can support multiple forms of authentication for the same vault.
I also strongly recommend replacing AES with XCHacha20 + Poly1305.
@lacorte I apreciate that, I’ll reformulate soon!
Sign in to join the conversation.