password-hashes VS awesome-rust

I would say a toy (or personal-use-only) password manager is a relatively simple project. If we are to forget about the GUI parts, you need to determine serialization of your password database (bincode + serde should be enough) and how to encrypt it. For the latter you need only two algorithms: a password hash for deriving encryption key from password and optional salt (the latter is usually randomly generated and stored as a "key file"), and an AEAD algorithm for encrypting and decrypting serialized database. There are certain pitfalls with encryption (e.g. you should not reuse nonce with the same key, especially with modes like GCM) and with properly erasing sensitive data from memory, as well as preventing it from leaking to things like swap, but learning about those is part of the learning experience.

I 'cheated' by forwarding everything to their separate Rust libraries which are maintained by https://github.com/RustCrypto/password-hashes . Ofcourse by adding the Elixir wrapper this could have introduced security issues (sadly I don't have enough knowledge about how NIF's handle memory ect. to test/check this myself)

As noted in the announcement, it's using the latest OWASP recommended parameters for Argon2, namely Argon2id with 19 MiB of memory, an iteration count of 2, and 1 degree of parallelism.

For password handling, I have had good experience with password-hash and the various algorithm implementations in the password-hashes repo.

It can be tricky to find learning resources that is perfectly tailored to the exact point we’re you’re standing right now. Especially if you already have prior experience.

But since you’re already familiar with programming, perhaps just dive right in…?

I.e. start a new project in Rust. You could do something like Advent of Code, Project Euler or Cryptopals[0]. Or write a simple webserver or whatever you feel like.

Don’t forget that ChatGPT can be quite useful for stuff like this. You can use it like a mentor. Just ask it anything you want to, make it show you examples (and then more examples) and so on. The answers might not be correct all of the time, but at least it can give you an idea of what docs to read next.

If you’re looking for blog posts, an acquaintance of mine has written some: https://priver.dev/tags/rust/

For more links to code/learning resources, see https://github.com/rust-unofficial/awesome-rust

And if you get stuck you also have the official Rust chats on Zulip/Discord.

HTH. Best of luck!

[0] https://cryptopals.com/

View on GitHub

I did find the official https://doc.rust-lang.org/book/ quite useful, it's more than enough to understand the language itself. Command-line programing is not a complicated thing, basically you have the CLI arguments, environment variables, stdin-stdout-sterr and nothing else. A few crates to start with: clap, dotenv, config, log4rs. Just go the crate documentation, there are many good examples there, no other book is neccessary. If you have a specific problem to solve, start to browse crates.io or https://github.com/rust-unofficial/awesome-rust for possible solutions.

37. Awesome Rust is a great repo with a huge curated list of plenty with Rust code and resources. You can find complete applications in different areas that were built based on Rust.

Post it there https://github.com/rust-unofficial/awesome-rust

I'd recommend taking a look at https://github.com/rust-unofficial/awesome-rust and seeing if anything interests you that way.

Not really sorted by complexity, but awesome-rust might be close to what you're looking for.

See also:

https://github.com/rust-unofficial/awesome-rust

This list is currently far more comprehensive, and it's filled with a lot of high-quality crates.