scrypt

First of all I know that "implementing your own cryptography is bad". However, at some point, one does stumble upon a use-case that is not (well) covered by existing tools. Now, assuming one has already done his due-diligence and has read (and hopefully understood at least the main ideas of) cryptography related RFC's / papers / articles / posts / etc. (especially in the area pertaining to what one wants to build), and thus we can assume one is not a complete newbie in this mater, however, nor is he an expert. Basically we can assume he is an "amateur". Where would one go with his design to ask for feedback about it, in the hope to at least eliminate some weaknesses that one (as a non expert) might have overlooked. (I'm not speaking here about "proofs" or "audits".) ---- More specifically ---- but please let's not get into this right n

https://github.com/Tarsnap/scrypt Side note, I've seen a number of places (including the Scrypt repo) compare bcrypt brute-force benchmarks without specifying the bcrypt work factor. It's very frustrating to see this, considering the time to compute a single bcrypt hash can be < 0.01 seconds (ie. work factor 7 or 8), or more than 1 minute (ie. work factor 20). I'm not familiar with scrypt, but it looks like instead of providing a work factor, you can provide inputs like "max time to compute hash" and "max percent of ram to use computing hash" which presumably scales up as hardware becomes more powerful?

The "key" of a "key derivation function" typically stores all that information. For example, see the format for scrypt: https://github.com/Tarsnap/scrypt/blob/master/FORMAT

Unless compatibility with gpg is a requirement, I think scrypt[0] is a much simpler tool for file encryption. The utility is meant to showcase the KDF of the same name. It's very simple and has virtually no parameters. So: $ xz -k elrond_minutes.txt $ scrypt enc elrond_minutes.txt.xz elrond_minutes.txt.xz.enc $ signify -S \ -s vilya.key \ -m elrond_minutes.txt.xz.enc \ -x elrond_minutes.txt.xz.enc.sig $ rm elrond_minutes.txt{,.xz} Signing the final output is probably extraneous; I think scrypt uses a HMAC. This involves invoking multiple tools, but since each tool only does one thing it's much easier to reason about, and I prefer this over using an omnibus tool like gpg. [0] https://github.com/Tarsnap/scrypt