From 80e6f569fe1222049c18a35a1fff22d53e428e65 Mon Sep 17 00:00:00 2001 From: Evan Su <48808396+HACKERALERT@users.noreply.github.com> Date: Sat, 20 Feb 2021 13:53:30 -0500 Subject: [PATCH] Update README.md --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index cdcdc59..98cf842 100644 --- a/README.md +++ b/README.md @@ -31,7 +31,9 @@ Security is Picocrypt's sole focus. I was in need of a secure, reliable, and fut For key derivation, Picocrypt uses Argon2ID, winner of the PHC (Password Hashing Competition), which was completed in 2015. Argon2ID is even slower than Scrypt and Bcrypt (for those that don't understand crypto, this is a good thing), making GPU, ASIC, and FPGA attacks impractical due to the huge amount of RAM that is used and written to during the key derivation. -Both XChaCha20-Poly1305 and Argon2ID are well recognized within the cryptography community and both are mature and future-proof. Let me get this clear: I did not write the crypto for Picocrypt. Instead, I followed cryptography's number one rule: Don't roll your own crypto. Picocrypt uses two Python libraries, argon2-cffi and pycryptodome, both of which are well known and popular within the Python community. For people who want to know how Picocrypt handles the crypto, or for the paranoid, here is a breakdown of how Picocrypt protects your data: +For key checking and CRCs, SHA3_512 (standardized Keccak) is used. Before decrypting, Picocrypt checks whether the password is correct by comparing the derived key to a SHA3_512 hash stored in the encrypted file. SHA3 is the latest standard for hashing recommended by the NIST. It's a modern and well-designed hash function that's open-source and unpatented. + +XChaCha20-Poly1305, Argon2, and SHA3 are well recognized within the cryptography community and are all mature and future-proof. Let me get this clear: I did not write the crypto for Picocrypt. Instead, I followed cryptography's number one rule: Don't roll your own crypto. Picocrypt uses two Python libraries, argon2-cffi and pycryptodome, both of which are well known and popular within the Python community. Picocrypt also uses Python's standard hashlib for SHA3_512. For people who want to know how Picocrypt handles the crypto, or for the paranoid, here is a breakdown of how Picocrypt protects your data:
  1. A 16-byte salt (for Argon2ID) and a 24-byte nonce (for XChaCha20) is generated using a CSPRNG (Python's os.urandom())