FEAT | Support GPU resistent KDF in SecureConfig

[sevenbitbyte]

🚀 Feature Proposal

We should use a more modern KDF which is GPU resistent.

A LUKs pbkdf2 partition was recently cracked using cloud services. (See Motivation 1)

It's recommended by cryptographers to use GPU resistent KDF functions such as argon2id. (See motivation 2)

Our current SecureConfig class only supports pbkdf2, making it fairly vulnerable to GPU cracking attacks.

The initial breach disclosure can be seen in Motivation 3

Goals

• GPU resistance
• Evaluate argon2
• Select specific argon2 algo (ie: argon2i vs argon2d vs argon2id)
• Allow selection of various KDFs, though we should likely default to argon2 if possible.

NodeJS

Support native nodejs, consider node-argon2

• https://github.com/ranisalt/node-argon2

Browser

Support browser, consider argon2-browser

• https://github.com/antelle/argon2-browser

Motivation

• 1 - https://kolektiva.social/@cedar/110214532879538171
• 2 - https://mjg59.dreamwidth.org/66429.html
• 3 - https://nantes.indymedia.org/posts/87395/une-lettre-divan-enferme-a-la-prison-de-villepinte-perquisitions-et-disques-durs-dechiffres/