5 ms·
> Add support for KDBX 4.0, Argon2 and ChaCha20 [#148, #1179, #1230, #1494] I can finally give this a shot without having to use the weird custom AES-based KDF
by piracykills 9y ago
> Add support for KDBX 4.0, Argon2 and ChaCha20 [#148, #1179, #1230, #1494]
I can finally give this a shot without having to use the weird custom AES-based KDF Keepass used to use. Awesome.
Congrats on the release.
- guessmyname 9y agoLast week I started reverse engineering the KDBX 3.1 file format (for fun). Does anyone knows where is the specification for KDBX 4.0? EDIT: Found it — https://github.com/keepassxreboot/keepassxc-specs https://github.com/keepassxreboot/keepassxc-specs
- danesparza 9y agoThis link also talks about changes to the spec for 4.x (but in more general terms): https://keepass.info/help/kb/kdbx_4.html https://keepass.info/help/kb/kdbx_4.html
- agildehaus 9y agoI don't believe the XML format has changed at all. Just the key derivation, stream cipher, and some changes to the binary header.
- hacking_nomad 9y agoThe XML Format has changed. Entries and Groups now support custom data. This was only supported on the database in KDBX3.1. Also, the settings now have a modified date which makes synchronising them when merging databases a lot easier. The other changes are done to the binary format as you say. Also to make the file smaller, attachments are now stored compressed "as is" instead of encoding them in base64 and adding them to the XML structure.
- minimaxir 9y agoWhat are the advantages/disadvantages of using Argon2/ChaCha20 over the current AES implementation? What are good parameters for those algos?
- piracykills 9y agoWell, in my amateurish opinion - there was nothing wrong with the existing AES encryption implementation. But they also had a key derivation function based on running many iterations of AES, which was weird and non-standard, I mean it seemed like it would work, but it's not proven in the cryptographic community. Now they've switched to Argon2 which is a very well reviewed KDF and I have a lot more faith in that. Code for the old KDF is here if anyone's interested: https://github.com/keepassxreboot/keepassxc/blob/7a55ab64d8393b0fa3af3450a98f85f8b0ab2331/src/crypto/kdf/AesKdf.cpp https://github.com/keepassxreboot/keepassxc/blob/7a55ab64d83...
- therealmarv 9y agoHow can I switch to the new system and new format easily?
- purerandomness 9y agoJust save the database file in the new format.
- zaarn 9y agoIn KPXC, simply open the database settings, switch into the security window and select Encryption method and KDF. Then save your database. Done.