4 ms·

Curious - why is argon2 still second to scrypt on this list? I'd also question the backup solution, I think Restic is a better option due to its flexibility, I

Curious - why is argon2 still second to scrypt on this list? I'd also question the backup solution, I think Restic is a better option due to its flexibility, I can do cheap backups to B2 and fairly reputable people seem to be approving of its cryptography: https://blog.filippo.io/restic-cryptography/ https://blog.filippo.io/restic-cryptography/ If anyone sees a reason why Tarsnap would be better (other than Percival's brand), I'd be quite interested.

lvh 9y ago
This is relevant: > But, seriously: you can throw a dart at a wall to pick one of these. Technically, argon2 and scrypt are materially better than bcrypt, which is much better than PBKDF2. In practice, it mostly matters that you use a real secure password hash, and not as much which one you use. It’s not so much a strict order of preference as it is a preference, any preference, so as to still be recommending things. Argon2 and scrypt are too close to call.
- piracykills 9y ago
  I'm under the impression Argon2 is at least marginally better than scrypt as it has heavily analyzed side channel mitigations and such. Is scrypt better in some other way?
  - lvh 9y ago
    Argon2 and the PHC precipitated a lot of analysis that increased our confidence in scrypt, too. My point is that it doesn’t really matter, so optimize for availability. I like Argon2 for the stamp of approval, but dislike all the confusion around parameter selection and i-vs-d confusion. (I know argon2id exists.)
    - piracykills 9y ago
      Doesn't scrypt suffer from much of the same parameter selection issues? I know I've had to choose some fairly obtuse values when using scrypt for login in a webapp. In fact, taking a quick look again I find Argon2's "memorySizeKB" and "iterations" make much more sense to me than scrypt's "CostFactor" and "BlockSizeFactor" parameters as it's a lot clearer what's being impacted. I agree with the i-vs-d confusion, but in most cases I think using argon2id as you mentioned should resolve the contention as is already the suggested default in the IETF draft.
      - lvh 9y ago
        Re parameter selection, I’m referring to: https://tools.ietf.org/html/draft-irtf-cfrg-argon2-03#section-4 https://tools.ietf.org/html/draft-irtf-cfrg-argon2-03#sectio... Specifically: > We recommend the following procedure to select the type and the parameters for practical use of Argon2. As opposed to just pick a profile, which, to be fair, the RFC also suggests :) So I guess that’s a fair point, it just feels like as with the i-vs-d thing there’s just more song and dance around it that I wish wasn’t there. The suggestion in the RFC vs published 3rd party recommendations (eg jjarmoc’s NNC reco) are also off by a factor of 100 or so? I’m happy to buy that that’s an unfair subjective impression, but when I was reviewing an argon2id python implementation last week I really just wanted to give people a function that just does “encrypt my damn password already”. Maybe that’s up to the implementation layers job, that’s fine - I did that for txscrypt too and I don’t remember where I got the magic numbers from :) To be clear in case someone else reads this out of context: I am not saying not to use Argon2id!
jlgaddis 9y ago
Thanks for the pointer to restic. I like and use tarsnap (and have for years) but the lack of choice of backends is a downside. I've been waiting for something I can use to backup my workstation and laptops to a server at home as well as a server I have at $work (ISP). I've tried out all the usual applications but have yet to find something I'm happy with. restic looks like it may fit the bill perfectly.
- ac29 9y ago
  +1 for restic. I've been using it for work-related backups for a while and it works quite well. rclone support has recently been added [0], expanding the number of storage backends available by quite a bit. [0] https://restic.net/blog/2018-04-01/rclone-backend https://restic.net/blog/2018-04-01/rclone-backend
- rsync 9y ago
  "I've been waiting for something I can use to backup my workstation and laptops to a server at home as well as a server I have at $work (ISP)." borg[1] has been referred to as "the holy grail of backups"[2] and is supported at rsync.net.[3] The end result is encrypted, zero knowledge remote backups on a ZFS filesystem that you can SSH to. I think everyone here knows all about rsync.net, but here are some examples:[4] ssh user@rsync.net sha256 some/file pg_dump -U postgres db | ssh user@rsync.net "dd of=db_dump" ssh user@rsync.net du -Ahd2 some/directory [1] https://borgbackup.readthedocs.io/en/stable/ https://borgbackup.readthedocs.io/en/stable/ [2] https://www.stavros.io/posts/holy-grail-backups/ https://www.stavros.io/posts/holy-grail-backups/ [3] http://rsync.net/products/attic.html http://rsync.net/products/attic.html [4] http://www.rsync.net/resources/howto/remote_commands.html http://www.rsync.net/resources/howto/remote_commands.html
  - Wingwing 9y ago
    This isn't zero-knowledge. Please use this opportunity to educate the public instead of muddying the term for the sake of marketing buzzwords.
    - 9y ago
comex 9y ago
Yeah. Here’s my situation, which I don’t think is especially uncommon: - My laptop has a 1TB disk, which is mostly full. I want to back it up. - Some of the data on it is sensitive. The vast majority is not - for example, a large fraction of the disk is taken up by torrented anime videos - but I don’t want to separate out only the sensitive data to back up securely. Not only would that be inconvenient, it would be wildly insecure, since I’d presumably want some other, potentially less secure backup solution for the rest of the data, and it’d be really easy to miss some sensitive data and have it accidentally included in the insecure backup. - Storing 1TB of data on Tarsnap for a year costs $3,000 (though after deduplication and compression there should be somewhat less than 1TB). - Storing 1TB of data on Amazon Glacier for a year costs $48, which can be combined with various open-source encryption tools (of varying quality). - Backblaze’s consumer backup product, which I currently use, costs $50 per year for unlimited storage; it supposedly does client-side encryption, though I don’t know how much I trust it. - One of those prices is not like the others. - I expect to have a larger disk in the future, and fill it up too; storing 2TB would double the Tarsnap and Amazon prices. - If Tarsnap actually made the difference between my data being compromised or not, that would be worth $3,000 or $6,000 to me, and I do have the means to spend that much if necessary. But in reality, I’d expect it to only slightly reduce the chance of compromise compared to a high-quality alternative, and I don’t have so much money (or arguably, I don’t value security highly enough?) that I can reasonably spend so much on that small of a benefit. - Why should you, the author of the post, or anyone else care that I’m stingy? Well, you don’t have to. But I’d certainly appreciate advice from experts about which of the alternatives are the best. In other words, what the right-est answer is that fits my budget constraints, even if it’s not actually the right answer. :) I don’t think the alternatives are all so insecure that it would be irresponsible to recommend any of them. - I have nothing against Colin personally; indeed, I wish him the best of success. I do think his pricing model doesn’t do a great job representing his costs, since the time he spends maintaining the Tarsnap software and servers, and providing support, doesn’t scale linearly with the amount of data stored. But there’s no rule it has to; it’s his choice. It’s just that the result is a service that isn’t for me.
Freaky 9y ago
Restic's threat model assumes trusted systems - the ability to make a backup also implies the ability to destroy and tamper with existing ones. Tarsnap has fine-grained access controls which can severely restrict hosts: https://www.tarsnap.com/man-tarsnap-keymgmt.1.html https://www.tarsnap.com/man-tarsnap-keymgmt.1.html e.g. you may give each host their own write-only key so they can automatically create new snapshots, while keeping the keys that permit reading and deleting old snapshots on separate machines with separate passphrases.

lvh 9y ago

This is relevant: > But, seriously: you can throw a dart at a wall to pick one of these. Technically, argon2 and scrypt are materially better than bcrypt, which is much better than PBKDF2. In practice, it mostly matters that you use a real secure password hash, and not as much which one you use. It’s not so much a strict order of preference as it is a preference, any preference, so as to still be recommending things. Argon2 and scrypt are too close to call.

piracykills 9y ago
I'm under the impression Argon2 is at least marginally better than scrypt as it has heavily analyzed side channel mitigations and such. Is scrypt better in some other way?
- lvh 9y ago
  Argon2 and the PHC precipitated a lot of analysis that increased our confidence in scrypt, too. My point is that it doesn’t really matter, so optimize for availability. I like Argon2 for the stamp of approval, but dislike all the confusion around parameter selection and i-vs-d confusion. (I know argon2id exists.)
  - piracykills 9y ago
    Doesn't scrypt suffer from much of the same parameter selection issues? I know I've had to choose some fairly obtuse values when using scrypt for login in a webapp. In fact, taking a quick look again I find Argon2's "memorySizeKB" and "iterations" make much more sense to me than scrypt's "CostFactor" and "BlockSizeFactor" parameters as it's a lot clearer what's being impacted. I agree with the i-vs-d confusion, but in most cases I think using argon2id as you mentioned should resolve the contention as is already the suggested default in the IETF draft.
    - lvh 9y ago
      Re parameter selection, I’m referring to: https://tools.ietf.org/html/draft-irtf-cfrg-argon2-03#section-4 https://tools.ietf.org/html/draft-irtf-cfrg-argon2-03#sectio... Specifically: > We recommend the following procedure to select the type and the parameters for practical use of Argon2. As opposed to just pick a profile, which, to be fair, the RFC also suggests :) So I guess that’s a fair point, it just feels like as with the i-vs-d thing there’s just more song and dance around it that I wish wasn’t there. The suggestion in the RFC vs published 3rd party recommendations (eg jjarmoc’s NNC reco) are also off by a factor of 100 or so? I’m happy to buy that that’s an unfair subjective impression, but when I was reviewing an argon2id python implementation last week I really just wanted to give people a function that just does “encrypt my damn password already”. Maybe that’s up to the implementation layers job, that’s fine - I did that for txscrypt too and I don’t remember where I got the magic numbers from :) To be clear in case someone else reads this out of context: I am not saying not to use Argon2id!

jlgaddis 9y ago

Thanks for the pointer to restic. I like and use tarsnap (and have for years) but the lack of choice of backends is a downside. I've been waiting for something I can use to backup my workstation and laptops to a server at home as well as a server I have at $work (ISP). I've tried out all the usual applications but have yet to find something I'm happy with. restic looks like it may fit the bill perfectly.

ac29 9y ago
+1 for restic. I've been using it for work-related backups for a while and it works quite well. rclone support has recently been added [0], expanding the number of storage backends available by quite a bit. [0] https://restic.net/blog/2018-04-01/rclone-backend https://restic.net/blog/2018-04-01/rclone-backend
rsync 9y ago
"I've been waiting for something I can use to backup my workstation and laptops to a server at home as well as a server I have at $work (ISP)." borg[1] has been referred to as "the holy grail of backups"[2] and is supported at rsync.net.[3] The end result is encrypted, zero knowledge remote backups on a ZFS filesystem that you can SSH to. I think everyone here knows all about rsync.net, but here are some examples:[4] ssh user@rsync.net sha256 some/file pg_dump -U postgres db | ssh user@rsync.net "dd of=db_dump" ssh user@rsync.net du -Ahd2 some/directory [1] https://borgbackup.readthedocs.io/en/stable/ https://borgbackup.readthedocs.io/en/stable/ [2] https://www.stavros.io/posts/holy-grail-backups/ https://www.stavros.io/posts/holy-grail-backups/ [3] http://rsync.net/products/attic.html http://rsync.net/products/attic.html [4] http://www.rsync.net/resources/howto/remote_commands.html http://www.rsync.net/resources/howto/remote_commands.html
- Wingwing 9y ago
  This isn't zero-knowledge. Please use this opportunity to educate the public instead of muddying the term for the sake of marketing buzzwords.
  - 9y ago

comex 9y ago

Yeah. Here’s my situation, which I don’t think is especially uncommon: - My laptop has a 1TB disk, which is mostly full. I want to back it up. - Some of the data on it is sensitive. The vast majority is not - for example, a large fraction of the disk is taken up by torrented anime videos - but I don’t want to separate out only the sensitive data to back up securely. Not only would that be inconvenient, it would be wildly insecure, since I’d presumably want some other, potentially less secure backup solution for the rest of the data, and it’d be really easy to miss some sensitive data and have it accidentally included in the insecure backup. - Storing 1TB of data on Tarsnap for a year costs $3,000 (though after deduplication and compression there should be somewhat less than 1TB). - Storing 1TB of data on Amazon Glacier for a year costs $48, which can be combined with various open-source encryption tools (of varying quality). - Backblaze’s consumer backup product, which I currently use, costs $50 per year for unlimited storage; it supposedly does client-side encryption, though I don’t know how much I trust it. - One of those prices is not like the others. - I expect to have a larger disk in the future, and fill it up too; storing 2TB would double the Tarsnap and Amazon prices. - If Tarsnap actually made the difference between my data being compromised or not, that would be worth $3,000 or $6,000 to me, and I do have the means to spend that much if necessary. But in reality, I’d expect it to only slightly reduce the chance of compromise compared to a high-quality alternative, and I don’t have so much money (or arguably, I don’t value security highly enough?) that I can reasonably spend so much on that small of a benefit. - Why should you, the author of the post, or anyone else care that I’m stingy? Well, you don’t have to. But I’d certainly appreciate advice from experts about which of the alternatives are the best. In other words, what the right-est answer is that fits my budget constraints, even if it’s not actually the right answer. :) I don’t think the alternatives are all so insecure that it would be irresponsible to recommend any of them. - I have nothing against Colin personally; indeed, I wish him the best of success. I do think his pricing model doesn’t do a great job representing his costs, since the time he spends maintaining the Tarsnap software and servers, and providing support, doesn’t scale linearly with the amount of data stored. But there’s no rule it has to; it’s his choice. It’s just that the result is a service that isn’t for me.

Freaky 9y ago

Restic's threat model assumes trusted systems - the ability to make a backup also implies the ability to destroy and tamper with existing ones. Tarsnap has fine-grained access controls which can severely restrict hosts: https://www.tarsnap.com/man-tarsnap-keymgmt.1.html https://www.tarsnap.com/man-tarsnap-keymgmt.1.html e.g. you may give each host their own write-only key so they can automatically create new snapshots, while keeping the keys that permit reading and deleting old snapshots on separate machines with separate passphrases.