3 ms·

> it'll deliver the encrypted blob to the client, so in theory if they really wanted to break your password they could tell the extension that it's encrypted wi

> it'll deliver the encrypted blob to the client, so in theory if they really wanted to break your password they could tell the extension that it's encrypted with a single round of the hash function That's incorrect. When you change the round count your master password is re-computed, and database is re-encrypted with the new hash. The server needs to return the round count so the client can generate the correct master password hash, if you ignore that and simply calculate it for e.g. 2 rounds, the master password hash won't match and therefore the AES-256 database won't decrypt. The way Lastpass works is straightforward... PBKDF2(password, rounds) -> AES256(hash, blob). If the rounds change then the resulting hash changes and therefore the database won't decrypt. Your second paragraph is quite confusing, in that I cannot make heads or tails of why you think you can use 2 rounds when e.g. 10,000 are specified previously. A correct round count is just as vital as a correct password in generating the correct hash.

simias 9y ago
I'm talking about the authentication to the lastpass server, not the decryption itself. Lastpass won't serve you the encrypted blob if you don't authenticate with their servers. To do this it computes a different key (using a different derivation function, but using the same "master" password as the encryption key) that it uses to log into the lastpass server. This key cannot be used to decrypt the blob because of the different derivation function, but the client asks the server how many rounds of the kdf to use for a given user by posting its email to https://lastpass.com/iterations.php https://lastpass.com/iterations.php . As you can see it defaults to 5000, but the client will gladly accept any value. Therefore the server can tell the client to send a key derived from only one iteration, it which case this code is run: https://github.com/lastpass/lastpass-cli/blob/623b344e898958133be01f88a5e21eae099611d4/kdf.c#L92-L94 https://github.com/lastpass/lastpass-cli/blob/623b344e898958... In other words if an hostile party gets access to the lastpass server they can instruct your client to send your master password protected by two rounds of sha256. If you have a strong password (as you should) it's not an issue, but clearly you can't count on thousands of rounds of the KDF as you might think.

simias 9y ago

I'm talking about the authentication to the lastpass server, not the decryption itself. Lastpass won't serve you the encrypted blob if you don't authenticate with their servers. To do this it computes a different key (using a different derivation function, but using the same "master" password as the encryption key) that it uses to log into the lastpass server. This key cannot be used to decrypt the blob because of the different derivation function, but the client asks the server how many rounds of the kdf to use for a given user by posting its email to https://lastpass.com/iterations.php https://lastpass.com/iterations.php . As you can see it defaults to 5000, but the client will gladly accept any value. Therefore the server can tell the client to send a key derived from only one iteration, it which case this code is run: https://github.com/lastpass/lastpass-cli/blob/623b344e898958133be01f88a5e21eae099611d4/kdf.c#L92-L94 https://github.com/lastpass/lastpass-cli/blob/623b344e898958... In other words if an hostile party gets access to the lastpass server they can instruct your client to send your master password protected by two rounds of sha256. If you have a strong password (as you should) it's not an issue, but clearly you can't count on thousands of rounds of the KDF as you might think.