4 ms·
This password manager seems to use private keys, so there is no passphrase used for encryption here. However, generally speaking, age uses scrypt for password
by FiloSottile 4y ago
This password manager seems to use private keys, so there is no passphrase used for encryption here.
However, generally speaking, age uses scrypt for password key derivation, with a default work factor of 2^18 (1 second on modern machines). Unlike GnuPG's S2K, scrypt is both CPU and memory hard.
- upofadown 4y agoThen how short can I make my passphrase? It should be shorter than with GnuPG but no one knows how long to make the passphrase for GnuPG either... This gets back to my original peeve. This sort of thing has to be worked out for the user. I looked through the available documentation. Was I as a user expected to look through the source code and figure it out for myself?
- woodruffw 4y agoMy understanding is that, even with a CPU and memory-hard KDF, the standard recommendation is to use a strong and difficult to guess password. It’s meant to be a layer of protection against cracking, not an opportunity to use a shorter password than you normally would.