search

dyne / tomb

the Crypto Undertaker
https://dyne.org/software/tomb
GNU General Public License v3.0
1.34k stars 153 forks source link

KDF iteration time is wrong #192

Closed boyska closed 9 years ago

boyska commented 9 years ago

The --kdf option allows the user to enforce kdf. Its argument is said (not very clearly, actually) to be the number of seconds that it will take to do stretching on that box.

Since the getiter program takes an input the microseconds, the number of seconds should be multiplied by one million. Instead, it is multiplied by 10k. see https://github.com/dyne/Tomb/blob/master/tomb#L1141 It is even documented: https://github.com/dyne/Tomb/blob/master/doc/tomb.1#L198

I propose to:

and I am willing to do it myself, if you agree.

boyska commented 9 years ago

pull request opened!

jaromil commented 9 years ago

wait a second. will this break the iteration settings of previously created tombs?

I was aware of this problem, but never fixed it in doubt.

boyska commented 9 years ago

nope. The iteration count will never be the same running twice. The iteration count is calculated once, then written in the tomb header as one of the kdf parameter (the other being the salt).

jaromil commented 9 years ago

Oh, I see. I panicked seeing this pull merged so fast.

jaromil commented 9 years ago

I reverted the reverts. Thanks for the cold-blood fix.

Ideally, I'd like to switch to gnupg -s2k in some future.