Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

KDF parameters missing units in Encryption Settings #10558

Open
sandwm opened this issue Apr 6, 2024 · 2 comments
Open

KDF parameters missing units in Encryption Settings #10558

sandwm opened this issue Apr 6, 2024 · 2 comments
Labels

Comments

@sandwm
Copy link

sandwm commented Apr 6, 2024

Overview

In Database Settings -> Security -> Encryption Settings, the units for memory usage (MiB) and parallelism (threads) only show after I disable and re-enable Advanced settings. Also, both default to 1 when units are not shown (compared to 64 MiB and 4 threads with units shown). My database currently uses AES-KDF, which I wanted to change to Argon2id.

Steps to Reproduce

Version A:

  1. have Advanced Settings on
  2. open database
  3. Database -> Database Security -> Encryption Settings
  4. change KDF from AES-KDF to Argon2id
  5. units don't show
  6. disable and re-enable Advanced Settings
  7. units show

Version B:

  1. have Advanced Settings off
  2. open database
  3. Database -> Database Security -> Encryption Settings
  4. enable Advanced Settings
  5. change KDF from AES-KDF to Argon2id
  6. units don't show
  7. disable and re-enable Advanced Settings
  8. units show

Expected Behavior

I would expect to see memory usage "64 MiB" and parallelism "4 threads" (or some other values, but including units) every time, including steps 5/6 above.

Actual Behavior

I see memory usage "1" and parallelism "1". Units are missing and the suggested values are the minimum possible, not some (I guess) recommended values.

Context

The database currently uses AES-KDF, which I want to change. I'm using KeePassXC from the Arch Linux package.

KeePassXC - Version 2.7.7
Revision: 68e2dd8

Qt 5.15.13
Debugging mode is disabled.

Operating system: Arch Linux
CPU architecture: x86_64
Kernel: linux 6.6.23-1-lts

Enabled extensions:

  • Auto-Type
  • Browser Integration
  • Passkeys
  • SSH Agent
  • KeeShare
  • YubiKey
  • Secret Service Integration

Cryptographic libraries:

  • Botan 3.3.0

Operating System: Linux
Desktop Env: i3
Windowing System: X11

@sandwm sandwm added the bug label Apr 6, 2024
@sandwm
Copy link
Author

sandwm commented Apr 6, 2024

Another note, but about the KDF selection itself (not the KDF parameters): In the box for Key Derivation Function, Argon2d is shown as "recommended", while Argon2id is not. This comment says that Argon2id is the default since KeePassXC 2.6.6. Other sources like the audit and RFC 9106 also recommend Argon2id over Argon2d. The KeePassXC documentation says in point 6 about Database Settings:

[...] We recommend using Argon2id to prevent against timing-based attacks. Argon2d offers maximum compatibility with other KeePass-based apps, the default settings provide sufficient protection against any known attacks.

Should the "recommended" string be moved to the Argon2id entry?

(Not sure whether this should be it's own issue.)

@sandwm
Copy link
Author

sandwm commented Apr 6, 2024

After having converted the database from AES-KDF to Argon2id, the settings show correctly at first try, i.e. without toggling Advanced Settings off and on again.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

1 participant