CypherVault - Is my security scheme secure?

​

https://preview.redd.it/s8ywxmde0n741.png?width=705&format=png&auto=webp&s=db9e97586db2e00b802056ba7aec43921c9e205e

​

I wish to use and distribute this app for securing banking related API keys (as well as social media passwords).

​

The project is in python and open source here:

https://github.com/litepresence/CypherVault/blob/master/cyphervault.py

primary feature:

- given `site` and `user` input:

- writes `password` to clipboard w/ xclip

- auto clears clipboard in 10 seconds

​

security features:

- reads/writes AES CBC encrypted password json to text file

- salt is 16 byte shake256 and generated in crypto secure manner w/ os.urandom

- new salt after every return to main menu and exit to prevent dictionary attack

- master password stretched to 400 megabytes to prevent GPU/FPGA attack

- master password hashed iteratively 1,000,000 times via traditional salted pbkdf sha512 to prevent brute attack

- master password rehashed iteratively via random order salted blake(sha3(sha512))) for novelty resistance

- only 3rd party module is "pycryptodome"; raises exception if deprecated "pycrypto" is found

- sudo system password required to edit the script

​

additional features:

- maintains plain text site/user json backup without passwords

- automatically audits weak passwords

- detects input of [[email protected]](mailto:[email protected]) formatted email address as `site` and skips `user` prompt

- bulk site/user/password import utility

- password suggestion utility

- single py script, strict procedural style

- 600 lines PEP8/Pylint (<400 lines of actual code without comments)

- WTFPL license

​

Linux only.

Penetration testing and security review welcome and appreciated!