I read the whitepaper, and while I have many questions one detail in particular jumped out at me:<p>&quot;The client authenticates with an X.509 certificate or a self-signed certificate
where the private key is derived from a passphrase. When a passphrase is used, the scrypt algorithm is used to derive
a private key from the passphrase. Information about the salt is stored server-side and is given before establishing an
authenticated encrypted connection.
... The symmetric key is derived from either the passphrase,
the private key in an X.509 certificate, or provided by a key management service (KMS).&quot;<p>You&#x27;re deriving a private key from a user-defined passphrase, then storing the salt used to derive the password <i>on the server</i>, which is defined to be untrusted. I understand you use scrypt to derive the private key, but this still seems like a massive, massive footgun. Database systems are usually kept up and running for a long time, like maybe even years. If the server gets the salt, isn&#x27;t it only a matter of time before even a very slow brute-force attack can re-derive the authentication credential and make whatever queries it wants?