[[!comment format=mdwn
 username="joey"
 subject="""comment 2"""
 date="2022-12-27T20:43:35Z"
 content="""
Including the salt in the key is an interesting idea. I am not sure I buy
that it would be secure.

Normally with scrypt (or argon2 etc), and a strong password, the attacker has
to make a huge number of guesses, and so the comparatively modest amount of
work per guess is enough to make it infeasible for them to succeed.

Here though, the attacker will only be interested in guessing the hashes of
known files that they care about. That might be millions of files and so be
a reasonable amount of work to try them all. Probably less work than a good
password, so the hash difficulty parameters would need to be turned up to
secure against that attacker.

But... If the attacker only cares about a single file, they only have to run
scrypt once.
"""]]
