Argon2

[dancerqueen]

what is the exact command to type in terminal to enable argon2?

Hi, so sorry to ask a simple question to all of you but its not simple for me...
I want to turn on argon2 but i dont know how. i see post #517 but i dont understand solution because i can enter command in terminal if im told what to type but i dont understand a lot of what im typing.

ALSO...is there somewhere that lists the commands to enter other optional features? i want to try some of them but dont know where to find the detailed command to enter for them.

last question...is there a command to upgrade from 2.9 to 2.11? im installing new linux distro and it has 2.9 in repo and i would like to install that and upgrade to 2.11 if possible.

thanks for helping me! i'm trying to learn this stuff but im not so smart so it takes me longer to learn thins but im trying.

[Narrat]

what is the exact command to type in terminal to enable argon2?

This is something one chooses when creating a keyfile for a tomb. So the command in question would look like:
tomb forge --kdf 3 --kdftype=argon2 nameof.key
Edit: tomb forge --kdf 3 --kdftype argon2 nameof.key
Somewhere in the output should the following line appear: tomb (*) Using KDF Argon2
(Beware: I choose the 3 randomly. You may choose a value to your own liking :) )

Hi, so sorry to ask a simple question to all of you but its not simple for me... I want to turn on argon2 but i dont know how. i see post #517 but i dont understand solution because i can enter command in terminal if im told what to type but i dont understand a lot of what im typing.

The usual reminder. Don't blindly type what a random person wrote on the internet :) Before executing check the help output or the man/info pages to gather an understanding of what is being done.

ALSO...is there somewhere that lists the commands to enter other optional features? i want to try some of them but dont know where to find the detailed command to enter for them.

Worthwhile to check for every program and not only tomb:

$ man <name of tool>
$ <name of tool> --help (or -h for shorthand)

With the help option you will usually get a concise list of possebilities and with the man page a more elaborate documentation. Which also allow to search for keywords.
https://wiki.gentoo.org/wiki/Man_page/Navigate if the topic of man-pages is new for you :)

last question...is there a command to upgrade from 2.9 to 2.11? im installing new linux distro and it has 2.9 in repo and i would like to install that and upgrade to 2.11 if possible.

This is a more elaborate topic.
First question would be: What distro did you choose? Some of the distros allow rather easily to create packages which can be installed with the package manager.
The classic way would be the holy trinity of

$ ./configure
$ make
# make install

if a project has a Makefile. Tomb does: https://github.com/dyne/tomb/blob/master/Makefile
But then one must make sure that all dependencies are installed. In case of tomb rather easy as it is a shell script.
And lastly one could adjust the $PATH env to create a folder for programs in $HOME where the new 2.11 tomb script could be placed and can take precedence over other installed tomb versions.

thanks for helping me! i'm trying to learn this stuff but im not so smart so it takes me longer to learn thins but im trying.

You're welcome and ask away.

[dancerqueen]

thanks so much for using your time to help me! I will try to learn quickly.....

So it seems like the argon2 is set up with each file at time its created, my misunderstanding was thinking it was set up 1 time somehow and would apply automatically to each file going forward. No problem now. I created a test file using your example and it worked fine.
Question1: What does the "3" value represent? I see it can be something else but Im not sure what to choose.
Question2: Is there a way to look at a file and see if Argon2 was used? I will have some that do and do not have it so it would be nice to be able to check at some time to see this if possible.

The linux distro i chose was the Devuan. I was hoping it would be easy to upgrade from tomb 2.9 to 2.11 since both are from the dyne org... If i need to install as new I will try that way if needed. I read on the web that the following will install the needed apps for the tomb to run, is this correct?
sudo apt install gnupg zsh cryptsetup pinentry-curses
Before i was just using the version in the distro that was available but now I want to use the 2.11 version and the 2.9 version is what is available from within Devuan.

do you recommend any other options to use for security, i'm most interested in the most secure way to have the file. seems like now it will be aes256 and the argon2 used if i understand correctly. i will be storing the password on external device. anything you can help me with is great. i'm using this to protect all my important data like banking and doctor info. I will be writing down all this in deetail for my family if something happens to me and i will try to teach this to them so they can also use to protect their info if they are interested.

thanks again for helping me get better with this!!!!!

[Narrat]

thanks so much for using your time to help me! I will try to learn quickly.....

So it seems like the argon2 is set up with each file at time its created, my misunderstanding was thinking it was set up 1 time somehow and would apply automatically to each file going forward. No problem now. I created a test file using your example and it worked fine.

It is a one time operation in that sense that you create a keyfile to lock a tomb and this keyfile uses additional KDF to make the password of the keyfile more robust against bruce force attacks.
Some stuff to read on that topic ;)
https://en.wikipedia.org/wiki/Key_derivation_function
https://en.wikipedia.org/wiki/Argon2
https://en.wikipedia.org/wiki/PBKDF2
https://bitwarden.com/help/kdf-algorithms/
https://community.bitwarden.com/t/pbkdf2-vs-argon2-which-is-better/59187

Question1: What does the "3" value represent? I see it can be something else but Im not sure what to choose.

The number chosen there will represent the # of iterations. So 3 iterations from the example. (which is also the default for argon2)
Simply said iterations are how often it will reiterate the KDF part before it can be checked if the input is valid as a password.
Argon2 and pbkdf are different in that regard. With pbkdf you will see a high number of iterations (>10k), whereas argon2 has a default of 3. Difference comes through inner workings.

Question2: Is there a way to look at a file and see if Argon2 was used? I will have some that do and do not have it so it would be nice to be able to check at some time to see this if possible.

Yes. The keyfile itself is human readable. So you can simply use any program which can display text files. On the terminal this job could be done with cat or less. (Just don't save any changes to that file ;) )
If kdf was used, this will be visible from the first line in the keyfile, as the algorithm used will be visible there.

The linux distro i chose was the Devuan. I was hoping it would be easy to upgrade from tomb 2.9 to 2.11 since both are from the dyne org... If i need to install as new I will try that way if needed.

Not firm with the structure of dyne, but for me it is more of a governing body under which may likeminded projects can gather. Devuan itself is a project to remove systemd from Debian and therefore uses everything possible from the mother distribution to stay compatible in a way. And therefore the packages and versions are in general the same. Depending on what Debian version it is build upon this may take some time.
Debian itself offers the following:

• buster (older supported release): tomb 2.5
• bullseye (older supported release): tomb 2.9
• bookworm (current release): tomb 2.9
• trixi (next big release): tomb 2.10
• sid (rolling release): tomb 2.10

I assume Sid will be first to get 2.11, but that depends on the maintainer of said package.

I read on the web that the following will install the needed apps for the tomb to run, is this correct?
sudo apt install gnupg zsh cryptsetup pinentry-curses

That is the bare minimum needed, yes. To see every optional feature of tomb: tomb --version

Before i was just using the version in the distro that was available but now I want to use the 2.11 version and the 2.9 version is what is available from within Devuan.

Then you either need to look into creating your own .deb package or install it via make install or put it into your $HOME directory.

do you recommend any other options to use for security, i'm most interested in the most secure way to have the file. seems like now it will be aes256 and the argon2 used if i understand correctly. i will be storing the password on external device. anything you can help me with is great. i'm using this to protect all my important data like banking and doctor info. I will be writing down all this in deetail for my family if something happens to me and i will try to teach this to them so they can also use to protect their info if they are interested.

That is such a difficult and general question and really depends on what one wants to achieve. More technical steps can reduce comfort and therefore make it difficult for non tech person to get access. Although that can be somewhat circumvented, as tomb has some extra tools (like little GUI helpers).
Did you think of options to tweak for tomb or additional programs?
In general the defaults are good and if you keep the keyfile on a separate device.. a lot done for the safety of your sensible personal data.
But don't forget Backups. If the external device gets lost...

thanks again for helping me get better with this!!!!!

Again you're welcome :)

[dancerqueen]

This is good info!!! I feel better now but will spend more time reading the stuff you linked to. I know this took you time to spend writing this for me and again I cant say thank you enough!!!

I going to play around with the argon2 for a while before I begin using it with important data and then I will create new folders with argon2 and move all the data stored in the existing files i have over to them.

I'm not so smart with the command line stuff but I figured out Tomb so far with the instructions on the web site and thanks to your help I'll be able to migrate to include the argon2, this would have taken me forever, if that was even possible, to figure this out myself. once i get this understood better i will write down easy instructions for my family to access my data if something happens to me. And yes, backups not forgotten...I learned this the hard way in the past and lost data because a hard drive was defective and all data got lost so now i make a few backup copies now.

Its people like you in the linux community that give me a reason to stay and keep learning and getting better because your nice and helpful to me with learning this type of stuff like with command line things. So thanks again...

[jaromil]

Thanks for taking care of answering @Narrat . All questions make sense, so much that I think this is useful input for a FAQ, ping @Sakrecoer .

[dancerqueen]

Thanks for noticing these chats and suggesting a FAQ!

[dancerqueen]

@Narrat A bit more help please....

I entered:
tomb dig -s 100 secrets3.tomb
tomb forge --kdf 3 --kdftype=argon2 secrets3.tomb.key
tomb lock -k secrets3.tomb.key secrets3.tomb

There was no output stating "Using KDF Argon2" or even just Argon2 anywhere.

I was able to open/close the file but I cant figure out how to confirm Argon2 was used.
I tried to open the keyfile with a text editor but what appeared was the encrypted text with Begin PGP and ending with End PGP just like when a .asc file is opened.

The only thing I new to do was open with
gpg --list-packets and gpg -vv --show-session-key --list-packets
but neither provided anything about Argon2

Please provide me w/any details I can try to confirm Argon2 or even get Argon2 to appear in the output in case I entered the info wrong creating the file.

Sorry for the trouble, I've tried all i can think of before contacting you again....

[Narrat]

libgcrypt20-dev is good. The README is in that regard outdated and needs an update.

And like you did with tomb itself the same applies for the kbd-keyes folder :) :

$ cd Tomb-2.11/extras/kdf-keys
$ make
$ sudo make install

[dancerqueen]

I think you got it working 4 me!!!!!!!!!
how does this look below?

this appears before the -----BEGIN PGP MESSAGE-----
_KDF_argon2_239bedd4429d1ff9d3a3cf1b1d754978bfb0657f968cf2918331334b4ca64e87_3_18_64

this appears in the terminal output
$ tomb forge --kdf 3 --kdftype argon2 argontest.key
tomb . Commanded to forge key argontest.key with cipher algorithm AES256
tomb . Using KDF to protect the key password (3 rounds)
tomb [W] This operation takes time. Keep using this computer on other tasks.
tomb [W] Once done you will be asked to choose a password for your tomb.
tomb [W] To make it faster you can move the mouse around.
tomb [W] If you are on a server, you can use an Entropy Generation Daemon.
512+0 records in
512+0 records out
512 bytes copied, 0.00270948 s, 189 kB/s
tomb () Choose the password of your key: argontest.key
tomb . (You can also change it later using 'tomb passwd'.)
tomb () Using KDF Argon2
tomb . memory used: 2^18
tomb . kdf salt: 239bedd4429d1ff9d3a3cf1b1d754978bfb0657f968cf2918331334b4ca64e87
tomb . kdf iterations: 3
tomb . Key is valid.
tomb . Done forging argontest.key
tomb (*) Your key is ready:

the key file for this also looks different. the color of this is orange with a image of a square with arrow inside pointed to the right.
the key file with no argon2 is green with image of a key in the middle.

does this all look good??????

[Narrat]

Yes, this looks good :)

[dancerqueen]

THANK YOU for stayin w/me & help me get this working. Dont know many who do this for me. I learn a lot from this and still gonna read the info you gave me to learn more.

1 last question please....
when doin the forge i been gettin this:
tomb [W] This poses a security risk.
tomb [W] You can deactivate all swap partitions using the command:
tomb [W] swapoff -a
tomb [W] [#163] I may not detect plain swaps on an encrypted volume.
tomb [W] But if you want to proceed like this, use the -f (force) flag.
tomb [E] Operation aborted.

so i been doin:
$ sudo swapoff -a
and then do the forge.

is this the way to do this best for security?

[Narrat]

No problem. In the end it was worthwhile for both sides.
Regarding your question and what you're doing. Yes, running swapoff removes a potential security risk. Although depending on the distribution sometimes swap partitions are per default encrypted nowadays. The tomb output mentions an issue here on github on this specific topic: #163
General short info on swap: https://wiki.archlinux.org/title/Swap
Simply said it is a store on the disk where RAM pages can be moved into. Needed if RAM needs are greater than available or suspend/hibernation on a Laptop is used. And therefore potential important and critical data could end up in the Swap.
Encrypted swap: https://wiki.archlinux.org/title/Dm-crypt/Swap_encryption
Is possible, but comes with disadvantages and cannot currently reliable detected by tomb. Therefore the advice to turn of swap space.