Re: [openpgp] Partial review of the crypto refresh

[Paul Wouters <[e-mail]>]

On Fri, 25 Nov 2022, Marcus Brinkmann wrote:

> The count consists of a "mantisse" between 16 and 31, and an exponent (to basis 2) between 6 and 21. The total count is mantisse*2^exponent, which is a
> number between 1024 and 65,011,712. With a blocksize of 512 bits (SHA-1, SHA-2), we have to divide by 64, giving an iteration count of up to approx. 1M.
> Computing SHA-1 can be done very quickly using standard CPUs (~100MH/s), GPUs (~20 GH/s), and dedicated ASICs (such as used for Bitcoin mining, total
> network capacity ~160 Million TeraHash/s!). We can now compute how hard it is to brute-force a PGP password. With a single GPU (such as an RTX3090 with 23
> GH/s) and 1M H/Password, we are looking at 2.3M password guesses per second. A stronger hash function only reduces this by a small factor (SHA-256: Faktor
> 2.3, SHA-512: Faktor 7), but really the only viable option here is a much stronger password. Using a uniformly distributed random password from a
> 64-letter alphabet (a-zA-Z0-9+/) and a password length of 14 characters (= 2^84 passwords), you can pretty much ignore the PGP S2K settings for now
> (ignoring QC).
> 
> Suggestion:
> 
>   If Argon2 is not available, Iterated and Salted S2K MAY be used if
>   care is taken to use a high octet count and a strong passphrase.
>   However, this method does not provide memory-hardness, unlike Argon2.

Any reason not to suggest 14 instead of "high" ? or say "high octect (14
or more) ?

Paul