Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

KeePass – questionable security

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 231 posts

Re: KeePass – questionable security

#61

Post by tptacek »

I don't know that an HN thread is the best venue to discuss crypto design flaws (you might be better off writing a POC of some kind and then publishing that), but yes, it is a little disquieting to see a sensitive application using AES without an authenticator.

To the many readers of this thread who believe they don't care about the integrity of their password vault, just its confidentiality:

The problem is you can't necessarily have confidentiality without integrity.

Sound cryptosystems that provide integrity checking rule out chosen ciphertext attacks against the cipher: in order to submit a ciphertext to such a system, you have to get past a cryptographically secure integrity check.

Without that check, attackers can feed a victim systematically corrupted ciphertexts, which the victim will dutifully decrypt, and observe the behavior of the victim in handling them. This is the basis for a whole family of "error oracle" side channel attacks.

You generally don't want to trust the confidentiality of a cryptosystem that doesn't check ciphertext integrity and rule out manipulated ciphertexts.

As the poster points out: this might matter a lot less for a system that runs purely offline. Or it might not. I lean towards "not a super plausible attack vector". But who knows? Why be OK with bad crypto?

Re: KeePass – questionable security

#63

Post by clark800 »

Open source, open standard, generative password manager with "two-factor" security using both a passphrase and a private key file: http://rampantlogic.com/entropass/

It only uses the industry standard pbkdf2-sha512 hashing algorithm, with no encrypted database, so it is much simpler and isn't susceptible to these kinds of issues.

Re: KeePass – questionable security

#64

Post by caskance »

Globz wrote: post #28
ethanbond wrote: post #20

Earlier quoted context omitted.

Why do you say TrueCrypt isn't safe? I only skimmed the audit, but it seemed to have an overall positive impression, no?

Well I believe it is safe for my personal purpose but if you read the note the author left on Truecrypt website/software you can clearly read : WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues If I recall the audit was positive but who knows why this message was plastered everywhere when "they" decided to call it quits.

Because it's the responsible thing to do. If you are going to stop development, that means outstanding issues will not be fixed.

Re: KeePass – questionable security

#65

Post by salibhai »

xenophonf wrote: post #36
negus wrote: post #4

Ok, your password database was affected by malicious modification. So what? How it can break the confidentiality of your data? Update: By the way, what's wrong with the bytearray compare code snippet?

Confidentiality isn't your only concern. You should also be worried about integrity and availability. From "On The Security of Password Manager Database Formats": Unfortunately, [KDBX4] introduces new vulnerabilities. Similarly to KDB, the main problem of this format is the lack of authentication of *hdr*. As such, is it susceptible to modifications... This modification is not detectable by the password manager... if…

How will you do that? It looks tricky to say the least: http://sourceforge.net/p/passwordsafe/discussion/134801/thre...

EDIT: It looks like you can clear out all the comments and other stuff in the db and export to Keepass v1 CSV and you should be able to import from that.

Re: KeePass – questionable security

#66

Post by sdrapkin »

1. It would be nice if someone like CodesInChaos (ie. someone with both crypto and .NET expertise) were to casually audit the KeePass 2.x codebase and do a write-up.

2. It would be nice to create a kdbx 3.0 (ix. next-gen) storage format, which does proper AEAD.

Re: KeePass – questionable security

#67

Post by gnud »

Nogwater wrote: post #52
imglorp wrote: post #25

Earlier quoted context omitted.

Do you care about that kind of side channel for an offline vault? If your adversaries are on your box while you operate your vault, then you have already lost because they will also have keyloggers, strace, etc.

What if they hack your dropbox account and get a copy of the vault that way? They're not on your box, but now they can try to break into your vault.

Well, the decryption code is open source. And they have the ciphertext. So what does a timing attack give the attacker?

If keeppass removes the possible timing attack, the attacker could just add it back in and use their own client, if they have a copy of your database.

Re: KeePass – questionable security

#68

Post by exhilaration »

sdrapkin wrote: post #44
xenophonf wrote: post #12

"On The Security of Password Manager Database Formats" ( https://www.cs.ox.ac.uk/files/6487/pwvault.pdf ) was a good review of KeePass, Password Safe, and others. As I understood it, only Password Safe provided both secrecy and data authenticity.

Step-1: open the above PDF. Step-2: search for "HMAC". Step-3: note which application uses HMAC. Step-4: you should prefer (3) to all others.

A note to other 1Password users like myself, per the linked PDF 1Password does not use HMAC.

Re: KeePass – questionable security

#69

Post by salibhai »

clark800 wrote: post #63

Open source, open standard, generative password manager with "two-factor" security using both a passphrase and a private key file: http://rampantlogic.com/entropass/ It only uses the industry standard pbkdf2-sha512 hashing algorithm, with no encrypted database, so it is much simpler and isn't susceptible to these kinds of issues.

It looks like its mainly used for storing site login/passwords. I like to store other things too in password files like credit card numbers, notes ,etc.
Post reply on HN