3 ms·

I'm no crypto or security expert, but this worries me: "For security, the online password databases are encrypted with client-side keys derived from your ma

I'm no crypto or security expert, but this worries me: "For security, the online password databases are encrypted with client-side keys derived from your master password" What is going on here? Does it hash my master password, generating a new pass? If so, this seems like it would only increase the number of bits in the possible keyspace but not increase the number of possible keys, while actually lowering security (since hash collisions can occur). This worries me because non-standard crypto applications tend to actually introduce holes and vulnerabilities. What other vulnerabilities lie hidden here?

throwaway41597 12y ago
I'm no expert but I see no harm here. In order to use symmetric encryption, you need a certain key size (e.g. 128-bit key for AES-128). How do you transform a password of, say, 15 characters to 128 bits? You guessed it, with a hash (well a key derivation function to slow down brute force). What they do is I think standard practice. > but not increase the number of possible keys So yes, if your password is weak, then it won't make it strong. > while actually lowering security (since hash collisions can occur) But I think you're wrong here. On a human password of 30 bits of entropy, there is very little chance of collision. If one collision was to happen, you'd still have a key space of (30^2) - 1, which is very much the same number.
arantius 12y ago
My guess is they're using the standard approach for deriving an encryption key from a password: http://en.wikipedia.org/wiki/PBKDF2 http://en.wikipedia.org/wiki/PBKDF2
- gabriel34 12y ago
  Thanks for the clarification (and thanks to throwaway above as well), seems this is standard. Is there a salt in this implementation? Is it bruteforced the first time I open the database on a new device?
  - throwaway41597 12y ago
    It says the encryption is done client-side so a salt would be public. edit: they may be salting with the username or email address.

throwaway41597 12y ago

I'm no expert but I see no harm here. In order to use symmetric encryption, you need a certain key size (e.g. 128-bit key for AES-128). How do you transform a password of, say, 15 characters to 128 bits? You guessed it, with a hash (well a key derivation function to slow down brute force). What they do is I think standard practice. > but not increase the number of possible keys So yes, if your password is weak, then it won't make it strong. > while actually lowering security (since hash collisions can occur) But I think you're wrong here. On a human password of 30 bits of entropy, there is very little chance of collision. If one collision was to happen, you'd still have a key space of (30^2) - 1, which is very much the same number.

arantius 12y ago

My guess is they're using the standard approach for deriving an encryption key from a password: http://en.wikipedia.org/wiki/PBKDF2 http://en.wikipedia.org/wiki/PBKDF2

gabriel34 12y ago
Thanks for the clarification (and thanks to throwaway above as well), seems this is standard. Is there a salt in this implementation? Is it bruteforced the first time I open the database on a new device?
- throwaway41597 12y ago
  It says the encryption is done client-side so a salt would be public. edit: they may be salting with the username or email address.