5 ms·

"On The Security of Password Manager Database Formats" (https://www.cs.ox.ac.uk/files/6487/pwvault.pdf https://www.cs.ox.ac.uk/files/6487/pwvault.pdf) was a goo

"On The Security of Password Manager Database Formats" (https://www.cs.ox.ac.uk/files/6487/pwvault.pdf https://www.cs.ox.ac.uk/files/6487/pwvault.pdf) was a good review of KeePass, Password Safe, and others. As I understood it, only Password Safe provided both secrecy and data authenticity.

sdrapkin 11y ago
Step-1: open the above PDF. Step-2: search for "HMAC". Step-3: note which application uses HMAC. Step-4: you should prefer (3) to all others.
- xenophonf 11y ago
  I agree completely.
- namtrac 11y ago
  Linux support seems to be BETA.
  - jansc 11y ago
    Where did you get that information?
    - abrowne 11y ago
      http://passwordsafe.sourceforge.net/news.shtml http://passwordsafe.sourceforge.net/news.shtml Under 28 Dec 2014 it mentions 0.95, but there is a 0.96 from 12 June of 2015 available at http://sourceforge.net/projects/passwordsafe/files/Linux-BETA/ http://sourceforge.net/projects/passwordsafe/files/Linux-BET...
- exhilaration 11y ago
  A note to other 1Password users like myself, per the linked PDF 1Password does not use HMAC.
  - mscrivo 11y ago
    According to [0], it does: "The OPVault format uses Encrypt-then-MAC for authenticated encryption with AES-CBC-256 for encryption and HMAC-SHA256 for Message Authentication. Key derivation uses PBKDF2-HMAC-SHA512" [0] https://support.1password.com/encryption/ https://support.1password.com/encryption/
  - NeatoJn 11y ago
    I suppose some of the results are obsolete. For example, 1P is now already at version 5. Version 2 was about 5 years ago.
ufo 11y ago
If only I had heard of this article earlier. I actually downloaded the source code to a bunch of these tools to see if they properly implemented their crypto... That said, even PassWord safe has some issues. As the article points out, it computes an HMAC over the unencripted contents instead of over the encrypted ones. Encrypt-and-MAC isn't broken like MAC-then-encrypt but its still not as ideal as Encrypt-then-MAC.
- newman314 11y ago
  "Ferguson and Schneier, in their book Practical Cryptography, have argued the opposite: that MAC-then-encrypt (or MAC-and-encrypt) is the "natural" order and that encrypt-then-MAC is overly complex. The sore point of encrypt-then-MAC is that you have to be careful about what you MAC: you must not forget the IV, or (in case the protocol allows algorithm flexibility) the unambiguous identifier for the encryption algorithm; otherwise, the attacker could change either, inducing a plaintext alteration which would be undetected by the MAC. To prove their point, Ferguson and Schneier describe an attack over an instance of IPsec in which the encrypt-then-MAC was not done properly." http://crypto.stackexchange.com/a/224 http://crypto.stackexchange.com/a/224
  - tptacek 11y ago
    I think Ferguson and Schneier got this wrong. Here's a useful table from Bellare & Namprempre: https://www.dropbox.com/s/f4gpc7shjal1nta/Screenshot%202015-06-16%2018.38.02.png?dl=0 https://www.dropbox.com/s/f4gpc7shjal1nta/Screenshot%202015-... https://cseweb.ucsd.edu/~mihir/papers/oem.pdf https://cseweb.ucsd.edu/~mihir/papers/oem.pdf You generally have two options when it comes to authenticated encryption: use a specialized AEAD mode, in which the details of authentication are settled by the mode itself, or use "generic composition" --- encrypt securely, MAC securely, and safely combine the two operations. Specialized AEAD modes are preferable. But if you're going to do generic composition, the best current practice is encrypt-then-MAC. Even if you encrypt-then-MAC, you can still forget to authenticate parameters (a good reason not to use generic composition). But if you MAC and then encrypt, you concede to attackers the ability to target the cipher's decryption operation directly with chosen-ciphertext attacks. Those attacks are powerful and have repeatedly broken TLS; they're also the most common form of attack on other cryptosystems (every padding oracle attack is a variant of them). I wrote a bunch about this here: http://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/ http://sockpuppet.org/blog/2013/07/22/applied-practical-cryp...
omouse 11y ago
Interesting, I'm using KeePassX and I've seen the corruption issue; some of the fields are duplicated to other fields in other password entries. It's a little disturbing that this is an issue but I've been using the same KDB file for the last 5? years and it hasn't been completely corrupted.
hackuser 11y ago
Thank you! Also, I found a slightly better link, not directly to the PDF but to a page with the abstract and other info: http://www.cs.ox.ac.uk/publications/publication7166-abstract.html http://www.cs.ox.ac.uk/publications/publication7166-abstract...
McElroy 11y ago
Password Safe seems interesting. Too bad it's hosted on Source Forge.

sdrapkin 11y ago

Step-1: open the above PDF. Step-2: search for "HMAC". Step-3: note which application uses HMAC. Step-4: you should prefer (3) to all others.

xenophonf 11y ago
I agree completely.
namtrac 11y ago
Linux support seems to be BETA.
- jansc 11y ago
  Where did you get that information?
  - abrowne 11y ago
    http://passwordsafe.sourceforge.net/news.shtml http://passwordsafe.sourceforge.net/news.shtml Under 28 Dec 2014 it mentions 0.95, but there is a 0.96 from 12 June of 2015 available at http://sourceforge.net/projects/passwordsafe/files/Linux-BETA/ http://sourceforge.net/projects/passwordsafe/files/Linux-BET...
exhilaration 11y ago
A note to other 1Password users like myself, per the linked PDF 1Password does not use HMAC.
- mscrivo 11y ago
  According to [0], it does: "The OPVault format uses Encrypt-then-MAC for authenticated encryption with AES-CBC-256 for encryption and HMAC-SHA256 for Message Authentication. Key derivation uses PBKDF2-HMAC-SHA512" [0] https://support.1password.com/encryption/ https://support.1password.com/encryption/
- NeatoJn 11y ago
  I suppose some of the results are obsolete. For example, 1P is now already at version 5. Version 2 was about 5 years ago.

ufo 11y ago

If only I had heard of this article earlier. I actually downloaded the source code to a bunch of these tools to see if they properly implemented their crypto... That said, even PassWord safe has some issues. As the article points out, it computes an HMAC over the unencripted contents instead of over the encrypted ones. Encrypt-and-MAC isn't broken like MAC-then-encrypt but its still not as ideal as Encrypt-then-MAC.

newman314 11y ago
"Ferguson and Schneier, in their book Practical Cryptography, have argued the opposite: that MAC-then-encrypt (or MAC-and-encrypt) is the "natural" order and that encrypt-then-MAC is overly complex. The sore point of encrypt-then-MAC is that you have to be careful about what you MAC: you must not forget the IV, or (in case the protocol allows algorithm flexibility) the unambiguous identifier for the encryption algorithm; otherwise, the attacker could change either, inducing a plaintext alteration which would be undetected by the MAC. To prove their point, Ferguson and Schneier describe an attack over an instance of IPsec in which the encrypt-then-MAC was not done properly." http://crypto.stackexchange.com/a/224 http://crypto.stackexchange.com/a/224
- tptacek 11y ago
  I think Ferguson and Schneier got this wrong. Here's a useful table from Bellare & Namprempre: https://www.dropbox.com/s/f4gpc7shjal1nta/Screenshot%202015-06-16%2018.38.02.png?dl=0 https://www.dropbox.com/s/f4gpc7shjal1nta/Screenshot%202015-... https://cseweb.ucsd.edu/~mihir/papers/oem.pdf https://cseweb.ucsd.edu/~mihir/papers/oem.pdf You generally have two options when it comes to authenticated encryption: use a specialized AEAD mode, in which the details of authentication are settled by the mode itself, or use "generic composition" --- encrypt securely, MAC securely, and safely combine the two operations. Specialized AEAD modes are preferable. But if you're going to do generic composition, the best current practice is encrypt-then-MAC. Even if you encrypt-then-MAC, you can still forget to authenticate parameters (a good reason not to use generic composition). But if you MAC and then encrypt, you concede to attackers the ability to target the cipher's decryption operation directly with chosen-ciphertext attacks. Those attacks are powerful and have repeatedly broken TLS; they're also the most common form of attack on other cryptosystems (every padding oracle attack is a variant of them). I wrote a bunch about this here: http://sockpuppet.org/blog/2013/07/22/applied-practical-cryptography/ http://sockpuppet.org/blog/2013/07/22/applied-practical-cryp...

omouse 11y ago

Interesting, I'm using KeePassX and I've seen the corruption issue; some of the fields are duplicated to other fields in other password entries. It's a little disturbing that this is an issue but I've been using the same KDB file for the last 5? years and it hasn't been completely corrupted.

hackuser 11y ago

Thank you! Also, I found a slightly better link, not directly to the PDF but to a page with the abstract and other info: http://www.cs.ox.ac.uk/publications/publication7166-abstract.html http://www.cs.ox.ac.uk/publications/publication7166-abstract...

McElroy 11y ago

Password Safe seems interesting. Too bad it's hosted on Source Forge.