thePR0M3TH3AN/SeedPass
1
0 Fork 0
mirror of https://github.com/PR0M3TH3AN/SeedPass.git synced 2026-11-03 03:12:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix weak key derivation by adding salt to parent seed encryption

Browse Source 
Introduced a random salt to key derivation for parent seed encryption to prevent rainbow table attacks. The salt is now stored in the `parent_seed.enc` file header (V3 format).

*   Modified `src/utils/key_derivation.py` to accept optional `salt` argument.
*   Modified `src/seedpass/core/encryption.py` to read/write salt in `parent_seed.enc` using V3 format (V3:salt:nonce:ciphertext).
*   Modified `src/seedpass/core/manager.py` to generate salt for new seeds and read salt for existing ones.
*   Added auto-upgrade logic for legacy (no salt) seeds upon access.
*   Updated tests to verify salt usage and backward compatibility.

Co-authored-by: PR0M3TH3AN <[email protected]>
This commit is contained in:
google-labs-jules[bot]andPR0M3TH3AN committed 2026-02-16 17:22:54 +00:00
1 parent 335de7abe3
commit 75fe5bc382
4 files changed
+118 -27
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/tests/test_kdf_modes.py
+3 -1
View File
@@ -65,7 +65,9 @@ def test_setup_encryption_manager_kdf_modes(monkeypatch):
if mode == "argon2":
monkeypatch.setattr(
"seedpass.core.manager.derive_key_from_password_argon2",
lambda pw: derive_key_from_password_argon2(pw, **argon_kwargs),
lambda pw, salt=None: derive_key_from_password_argon2(
pw, salt=salt if salt is not None else b"\x00" * 16, **argon_kwargs
),
)
monkeypatch.setattr(PasswordManager, "initialize_bip85", lambda self: None)
monkeypatch.setattr(