scrypt: Increase log_n until it is measurable

Closes #418.

age/CHANGELOG.md

@@ -17,6 +17,8 @@ to 1.0.0 are beta releases.
 - Migrated to `base64 0.21`, `rsa 0.9`.
 
 ### Fixed
+- `age::Encryptor::with_user_passphrase` will now re-measure the `scrypt` work
+  factor until it is measurable, instead of setting the work factor to maximum.
 - `age::cli_common`:
   - `UiCallbacks::confirm` no longer requires erasing the confirmation message
     before it will accept a response.

age/src/scrypt.rs

@@ -25,10 +25,7 @@ const ENCRYPTED_FILE_KEY_BYTES: usize = FILE_KEY_BYTES + 16;
 ///
 /// Guaranteed to return a valid work factor (less than 64).
 fn target_scrypt_work_factor() -> u8 {
-    // Time a work factor that should always be fast.
-    let mut log_n = 10;
-
-    let duration: Option<Duration> = {
+    let measure_duration = |log_n| {
         // Platforms that have a functional SystemTime::now():
         #[cfg(not(all(target_arch = "wasm32", not(target_os = "wasi"))))]
         {
@@ -61,6 +58,16 @@ fn target_scrypt_work_factor() -> u8 {
         }
     };
 
+    // Time a work factor that should always be fast.
+    let mut log_n = 10;
+    let mut duration: Option<Duration> = measure_duration(log_n);
+    while duration.map(|d| d.is_zero()).unwrap_or(false) {
+        // On some newer platforms, the work factor may be so fast that it is cannot be
+        // measured. Increase the work factor until we can measure something.
+        log_n += 1;
+        duration = measure_duration(log_n);
+    }
+
     duration
         .map(|mut d| {
             // Use duration as a proxy for CPU usage, which scales linearly with N.