I'm implementing encryption in one of my webextension which will encrypt locally stored data.
I have a single master CryptoKey
(AES-GCM) that encrypts everything.
And this master key is then encrypted (using crypto.subtle.wrapKey
) with:
- user password
- randomly generated "recovery code"
Both are hashed using PBKDF2 with 1e6 iterations of SHA-256 and 128 bit salt.
I want the recovery key to be numbers only, so how long should it be to be secure enough against local attacks?
(let's say someone copies the data to USB drive and hacks it at home).
For example BitLocker is using 48 digits long number. Is that good enough? I guess the complexity of hashing algorithm is highly correlating with required length and I don't know what BitLocker is using.