How should I configure my database? Chacha20 vs AES? Argon2

Whatever is the default

First one sounds good

File: 501549144.jpg (108KB, 509x338px) Image search: [Google]

108KB, 509x338px

doesnt matter, its the same to me.... kid

Argon2 for GPU attacks.

>>58642379
What will be in your db that you need full encryption? Do you store cp in your db? Why dont you store only passwords as hashed salt like everybody else?

>>58645134
Fuck off NSA shill

>>58642379
AES if you have hardware hardware acceleration like AES-NI (you probably do), Chacha20 otherwise. Argon2 if you will be using your database ONLY with Keepass (KeepassX doesn't support KDBX 4 yet), AES-KDF otherwise.

>>58645134
Why don't you shit with the door open?

>>58646352
I highly doubt that keepass even takes advantage of aes-ni

>>58642379
Don't use Argon2, it's too new to be trusted. Use scrypt instead.

>>58645633
>>58646401
So what exactly encrypted db does?
Intern people still have the access with keys otherwise they wouldnt be able to do their work. So it wont protect you against snowman accidents.

Your production server still have keys to it, otherwise it wouldnt work. So if breach happens at level of sql execute, your data leaks anyway. If breach happens at greater levels, you can extract keys from production server (or most likely just copy configs with keys) and grab whole db as well.

If swat breaks your server room, you need full hdd encryption to slow them. If only your db is encrypted, the chances of them recovering keys are very real. So again no advantage there.

Only if the attacker is dumb and simply copy your server's hdd or steal it. But then again hdd encryption does the same job, but faster without additional hassle with deploying product.

>>58646525
>too new to be trusted
>use scrypt
First of all, scrypt isn't a veteran itself.
In fact, Password Hashing Competition was held to develop an improved KDF. There were 24 submissions and Argon2 came out on top. The panel consisted of respected cryptographers including the author of scrypt so there's no reason not to trust Argon2. I think it's the opposite: Argon2 should be used more so it gains recognition, recieves public cryptanalisis and in case there are any issues they get fixed.

Not to mention the fact that Keepass doesn't offer scrypt so it's either AES-KDF or Argon2.