miracle091/Picocrypt
miracle091/Picocrypt
1
0
Fork 0
mirror of https://github.com/HACKERALERT/Picocrypt.git synced 2024-12-27 00:02:36 +01:00
Code Releases Activity

Add keyfile explanation

Browse Source
This commit is contained in:
Evan Su 2021-09-04 19:05:17 -04:00 committed by GitHub
parent 1d2f2900cf
commit 85f908e50f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 14 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
Internals.md
View File

@ -3,9 +3,19 @@ If you're wondering about how Picocrypt handles cryptography, you've come to the
# Core Cryptography
Picocrypt uses the following cryptographic primitives:
- XChaCha20 (cascaded with Serpent for paranoid mode)
- HMAC-SHA3 for normal mode, keyed-BLAKE2b for fast mode (256-bit key, 512-bit digest)
- HKDF-SHA3-256 for deriving a subkey used with the MAC above
- Argon2id (8 passes, 1 GiB memory, 8 threads) for normal mode, (4 passes, 128 MiB memory, 4 threads) for fast mode
- XChaCha20 (cascaded with Serpent-CTR for paranoid mode)
- HMAC-SHA3 for normal annd paranoid mode, keyed-BLAKE2b for fast mode (256-bit key, 512-bit digest)
- HKDF-SHA3-256 for deriving a subkey used with the MAC above, as well as a key for Serpent
- Argon2id:
- Fast mode: 4 passes, 128 MiB memory, 4 threads
- Normal mode: 4 passes, 1 GiB memory, 4 threads
- Paranoid mode: 8 passes, 1 GiB memory, 8 threads
All primitives used are from the well-known golang.org/x/crypto module.
# Keyfile Design
Picocrypt allows the use of keyfiles as an additional (or only) form of authentication. Picocrypt's unique "Require correct order" feature enforces the user to drop keyfiles into the window in the exact same order as he/she did when encrypting, in order to decrypt the volume successfully. Here's how it works:
If "Require correct order" is not checked, Picocrypt will take the SHA3 hash of each file individually, and XORs the hashes together. Finally, the result is XORed to the master key. Because the XOR operation is both commutative and associative, the order in which the keyfiles hashes are XORed to each other doesn't matter -- the end result is the same.
If "Require correct order" is checked, Picocrypt will combine (concatenate) the files together in the order they were dropped into the window, and take the SHA3 hash of combined keyfiles. If the order is not correct, the keyfiles, when appended to each other, will result in a different file, and therefore a different hash. Thus, the correct order of keyfiles has been enforced.