bruit-force

BTSync continues to be a very interesting project but I remain concerned about how vulnerable the shared secret is to bruit-force attack.

On average, it will take the Stasi an afternoon to bruit-force Password after pretending once to be Bob, and after that they can impersonate Alice when talking to Bob.

You're complaining about time for bruit-force attacks.

It's very unlikely Alice will ever mention to Bob the one failed authentication, and nearly impossible that she'll mention it within the window of time they have before the Stasi bruit-force the password.

Maybe there is such a threat model, but it has to be a very outside-the-box attack.) If you're worried about effort needed to bruit-force the password, use Argon2 or another memory-hard password hash/KDF.

The fast one-way function run server-side then prevents the client from being able to submit a stolen hash, forcing an attacker with a list of stolen hashes to perform the full expensive bruit-force attack.

What you may not understand is that because our government and those who control society are significantly more sophisticated than brutish regimes you are most likely thinking of, you don't seem to recognize the ruse and subtle means for propaganda that are used to maintain a certain state, rather than attempt to bruit-force a desirable outcome.

I thought about using something similar to Schnorr threshold signatures[0] to solve the information leakage, but then you end up storing one elliptic curve public key per password letter, and the private key for each public key is a single letter, so trivial to bruit-force.