#dusk $DUSK @Dusk A small table in Dusk’s wallet security notes made the word password feel misleading the browser extension uses PBKDF2-SHA-256 at 900,000 iterations, while the native route is described as Stronghold plus Argon2 and OS-level encrypted storage.
So the same password does not necessarily buy the same cracking resistance. Yet DUSK’s public material does not disclose enough native Argon2 detail memory cost, iteration count and parallelism to calculate how much harder an offline attack really is. Memory-hard is a design label, not a measured advantage.
There is another problem. Encryption at rest protects a locked vault. After unlock, the extension keeps the mnemonic in the JavaScript heap, clears it on lock or timeout, but cannot guarantee zeroization. A weak password can shrink the first defence malware, a hostile extension or a compromised device can step around it entirely.
That changes how I judge DUSK self-custody: password strength versus actual attack surface, not Argon2 versus PBKDF2 as brand names.
I would like DUSK to publish the full native KDF parameters, benchmark equal passwords across devices, and report how long key material remains exposed. Until then, saying DUSK uses Argon2 answers which tool exists, not how much protection users truly receive.
So the same password does not necessarily buy the same cracking resistance. Yet DUSK’s public material does not disclose enough native Argon2 detail memory cost, iteration count and parallelism to calculate how much harder an offline attack really is. Memory-hard is a design label, not a measured advantage.
There is another problem. Encryption at rest protects a locked vault. After unlock, the extension keeps the mnemonic in the JavaScript heap, clears it on lock or timeout, but cannot guarantee zeroization. A weak password can shrink the first defence malware, a hostile extension or a compromised device can step around it entirely.
That changes how I judge DUSK self-custody: password strength versus actual attack surface, not Argon2 versus PBKDF2 as brand names.
I would like DUSK to publish the full native KDF parameters, benchmark equal passwords across devices, and report how long key material remains exposed. Until then, saying DUSK uses Argon2 answers which tool exists, not how much protection users truly receive.