Honest question. What's wrong with the function?
I have a similar function to ironically enough compare Hmacs in an encryption program I wrote in Java and C#
When I release the source code for the java version I replaced my function with java's own Arrays.equals though
KeePass – questionable security
161–170 of 231 posts
Re: KeePass – questionable security
#162Earlier quoted context omitted.
I use and like 1Password.
And how do you save and sync the passwords across various machines? Edit: The reason I asked is because I wanted to see if 1Password can be more secure than LastPass. However, if you're using 1Password with Dropbox, I'd say this combination doesn't feel any more secure than LastPass. Other more secure options like WiFi sync aren't convenient enough. So, it appears there's no strong reason for me to consider switching…
BTSync + 1Password works fine.
Re: KeePass – questionable security
#163Earlier quoted context omitted.
Please remember that just because tptacek likes and uses something, do not mean that it has great security. The PDF linked below states that there is zero integrity in 1Password file format. I happen to like and use KeePass, but that is not a secure-software guarantee.
I agree with your first sentence. But, regarding the rest of your comment: We use Encrypt-then-MAC authenticated encryption everywhere we use encryption. The MAC is HMAC-SHA256 and encryption is AES-CBC using 256-bit keys. Key derivation is uses PBKDF2-HMAC-SHA512. More detail about these choices will be presented in the relevant sections on key derivation and item encryption. https://blog.agilebits.com/2013/03/06/yo…
I like and use 1Password too. But maybe someone smarter than I can explain what Goldberg is trying to say re 1Password and the paper "On the Security of Password Manager Database Formats" [1]
[1] https://discussions.agilebits.com/discussion/comment/127847/...
One thing, I never liked about the 1Password file format was it's insistence on leaving certain fields unencrypted in order to allow the app to search using those fields. I've pushed for a "high security" preference option were all fields are encrypted to not avail.
I'm willing to trade off the search convenience but that's a choice that Agilebits should allow me to make.
Re: KeePass – questionable security
#164"On The Security of Password Manager Database Formats" ( https://www.cs.ox.ac.uk/files/6487/pwvault.pdf ) was a good review of KeePass, Password Safe, and others. As I understood it, only Password Safe provided both secrecy and data authenticity.
If only I had heard of this article earlier. I actually downloaded the source code to a bunch of these tools to see if they properly implemented their crypto... That said, even PassWord safe has some issues. As the article points out, it computes an HMAC over the unencripted contents instead of over the encrypted ones. Encrypt-and-MAC isn't broken like MAC-then-encrypt but its still not as ideal as Encrypt-then-MAC.
"Ferguson and Schneier, in their book Practical Cryptography, have argued the opposite: that MAC-then-encrypt (or MAC-and-encrypt) is the "natural" order and that encrypt-then-MAC is overly complex. The sore point of encrypt-then-MAC is that you have to be careful about what you MAC: you must not forget the IV, or (in case the protocol allows algorithm flexibility) the unambiguous identifier for the encryption algorithm; otherwise, the attacker could change either, inducing a plaintext alteration which would be undetected by the MAC. To prove their point, Ferguson and Schneier describe an attack over an instance of IPsec in which the encrypt-then-MAC was not done properly."
Re: KeePass – questionable security
#165Earlier quoted context omitted.
I agree with your first sentence. But, regarding the rest of your comment: We use Encrypt-then-MAC authenticated encryption everywhere we use encryption. The MAC is HMAC-SHA256 and encryption is AES-CBC using 256-bit keys. Key derivation is uses PBKDF2-HMAC-SHA512. More detail about these choices will be presented in the relevant sections on key derivation and item encryption. https://blog.agilebits.com/2013/03/06/yo…
I like and use 1Password too. But maybe someone smarter than I can explain what Goldberg is trying to say re 1Password and the paper "On the Security of Password Manager Database Formats" [1] [1] https://discussions.agilebits.com/discussion/comment/127847/... One thing, I never liked about the 1Password file format was it's insistence on leaving certain fields unencrypted in order to allow the app to search using tho…
I don't know. I skimmed Gasti & Rasmussen 2012, and reread Goldberg's comment; unfortunately, I also just skimmed the source for for PasswordSafe V3, the "only one" that achieved "MAL-CDBA"; it appears to be cryptographically unsound (MAC-then-encrypt of an idiosyncratic AES-CBC).
Re: KeePass – questionable security
#166Earlier quoted context omitted.
If only I had heard of this article earlier. I actually downloaded the source code to a bunch of these tools to see if they properly implemented their crypto... That said, even PassWord safe has some issues. As the article points out, it computes an HMAC over the unencripted contents instead of over the encrypted ones. Encrypt-and-MAC isn't broken like MAC-then-encrypt but its still not as ideal as Encrypt-then-MAC.
"Ferguson and Schneier, in their book Practical Cryptography, have argued the opposite: that MAC-then-encrypt (or MAC-and-encrypt) is the "natural" order and that encrypt-then-MAC is overly complex. The sore point of encrypt-then-MAC is that you have to be careful about what you MAC: you must not forget the IV, or (in case the protocol allows algorithm flexibility) the unambiguous identifier for the encryption algori…
I think Ferguson and Schneier got this wrong. Here's a useful table from Bellare & Namprempre:
https://www.dropbox.com/s/f4gpc7shjal1nta/Screenshot%202015-...
https://cseweb.ucsd.edu/~mihir/papers/oem.pdf
You generally have two options when it comes to authenticated encryption: use a specialized AEAD mode, in which the details of authentication are settled by the mode itself, or use "generic composition" --- encrypt securely, MAC securely, and safely combine the two operations. Specialized AEAD modes are preferable. But if you're going to do generic composition, the best current practice is encrypt-then-MAC.
Even if you encrypt-then-MAC, you can still forget to authenticate parameters (a good reason not to use generic composition). But if you MAC and then encrypt, you concede to attackers the ability to target the cipher's decryption operation directly with chosen-ciphertext attacks. Those attacks are powerful and have repeatedly broken TLS; they're also the most common form of attack on other cryptosystems (every padding oracle attack is a variant of them).
I wrote a bunch about this here:
http://sockpuppet.org/blog/2013/07/22/applied-practical-cryp...
Re: KeePass – questionable security
#167What about pass ( http://www.passwordstore.org/ )? No "funky file formats" -- just GPG and a convenient CLI.
There are two things that bug me about pass: * Website names are stored in plaintext filenames and directory hierarchies. No confidentiality and no integrity guarantees for those. * It uses GPG's public-key encryption instead of symmetric-key encription. This integrates well with gpg-agent but it means that you need to carry a gpg private-key file around with you instead of just remembering a passphrase.
> carry a gpg private-key file around
You could get a yubikey (or other gpg smartcard) ;)
Re: KeePass – questionable security
#168Earlier quoted context omitted.
I agree with your first sentence. But, regarding the rest of your comment: We use Encrypt-then-MAC authenticated encryption everywhere we use encryption. The MAC is HMAC-SHA256 and encryption is AES-CBC using 256-bit keys. Key derivation is uses PBKDF2-HMAC-SHA512. More detail about these choices will be presented in the relevant sections on key derivation and item encryption. https://blog.agilebits.com/2013/03/06/yo…
I like and use 1Password too. But maybe someone smarter than I can explain what Goldberg is trying to say re 1Password and the paper "On the Security of Password Manager Database Formats" [1] [1] https://discussions.agilebits.com/discussion/comment/127847/... One thing, I never liked about the 1Password file format was it's insistence on leaving certain fields unencrypted in order to allow the app to search using tho…
Their newer format 'opvault' claims to address it as well as authentication - you're probably best off just googling 'opvault' for the various forum and blog posts about it. You can enable opvault in almost all the platform/sync combinations if you download the current v5 beta.
Re: KeePass – questionable security
#169Earlier quoted context omitted.
Too bad the only way to use 1Password with linux or a BSD is some jaxy browser extension.
jaxy?
http://www.letters4words.com/jaxy.htm
i.e. ass, poorly implemented, bad
Re: KeePass – questionable security
#170Earlier quoted context omitted.
The array comparison? It's literally the textbook example of a timing sidechannel. Though I won't speculate if it's a real problem here, since I have no idea what data is being compared.
I must admit, I can't immediately see the problem with leaking timing data. The client (that decrypts the password database) runs on your local computer, and typically places clear-text-passwords into the clipboard during normal use. So if your local computer is compromised you have way bigger problems than timing attacks.
It does have a mode that allows you to avoid clipboard sniffers if the program you are targeting supports it.
However most attack vectors on the local machine can usually get a hold of both keyboard and clipboard data making it impossible to prevent sniffing, but that does assume a sophisticated sniffer.