3 ms·
Main thing I don't like is their custom AES-based key derivation function. I'm also not sure if it does authenticated encryption but if I recall correctly it do
by ultramancool 11y ago
Main thing I don't like is their custom AES-based key derivation function. I'm also not sure if it does authenticated encryption but if I recall correctly it does not. I'll have to have a look at it again soon.
- briHass 11y agoI agree about the key-derivation (just use the PBKDF built into .NET dammit), but I've checked out the code, and it looks sound. It uses standard Windows crypto libs when running on >=Vista. As to the auth'd encryption: they do that above version 2.2 http://keepass.info/help/kb/sec_issues.html http://keepass.info/help/kb/sec_issues.html
- ultramancool 11y agoThanks, I'll definitely be keeping an eye on keepass, there's a post around indicating that they're going to add Argon2 (the winner of PHC) when it's finalized. I might just do the switch now...
- ww520 11y agoThanks for pointing out these issues. Authenticated encryption seems to get popular just these last couple years. Besides injecting unwanted data into the encrypted data, what other attacks can be done with it? For encrypted code, injecting unwanted code in the middle of it would be a big problem when decrypted and run. For pure data file like the the password database, would it be just adding extra garbage?