Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Review salts management #37

Open
davidloiret opened this issue Jan 24, 2025 · 1 comment
Open

Review salts management #37

davidloiret opened this issue Jan 24, 2025 · 1 comment

Comments

@davidloiret
Copy link
Collaborator

Currently, we are limited to using one salt per identity in the vault.

  • To retrieve the passphrase for an identity, we need to iterate over all available salts. This can lead to performance issues, especially when there are multiple identities to process.
  • For WebAuthn, the process requires the user to select a credential_id manually. This means the user must choose their WebAuthn identity before initiating authentication. Ideally, the identity selection should be handled directly within the Authenticator. However, since we cannot send multiple salts for each credential_id, this is not feasible.
  • Additionally, the user needs to know their public key when selecting from multiple recipient_ids. While we could store usernames to simplify this process, doing so introduces other challenges, such as handling scenarios where the vault is shared between multiple users.

Perhaps it is secure to use a single prf_salt and passphrase_salt per vault, even when managing multiple identities. If this approach is feasible, it would address all the outlined issues effectively.

@davidloiret davidloiret changed the title Review salt management Review salts management Jan 24, 2025
@oScape
Copy link
Contributor

oScape commented Jan 29, 2025

I just introduced username_pk: HashMap<String, String> for store the username linked to a public_key into the vault which enabled the authentication with webauthn. It was done with the user public_key before, I think its more user friendly to use a username instead of a public_key but, it might require some review with this PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants