Login.gov encryption is badly designed
This is mostly complaining about a lack of FIPS 140 compliance. While that might be a regulatory issue for a .gov site, technically-speaking FIPS compliance is a hinderance to building a sound system, not an aid.<p>Putting that aside, there might be some valid points in here: using Hash(IKM + nonce) to generate a key is probably not ideal, depending on what Hash is. That&#x27;s generally a job for HKDF. The post also mentions a &quot;non-approved KDF&quot; elsewhere, but doesn&#x27;t say what it is.<p>On the other hand, storing Hash(key) isn&#x27;t immediately an issue unless something else in the scheme depends on Hash(key) being secret, but the post implies without justification that it&#x27;s some sort of obvious error.<p>So there might well be some issues here, but this post doesn&#x27;t provide sufficient detail to condemn login.gov out of hand.