Re: PasswordSafe 3.0 weak random number generator allows key recovery attack
info@xxxxxxxxxxxxx wrote:
> Title : PasswordSafe 3.0 weak random number generator allows
> key recovery attack
> Date : March 23, 2006
> Product : PasswordSafe 3.0
Say, are you referring to /the/ PasswordSafe 3.0, you know, the one by
that Schneier guy, the one that's on sourceforge, .....
... the one that's still in BETA for god's sake and which comes plastered
in warnings like
" This is still a BETA release! It should NOT be used as the only tool for
storing "real" password information. For securely storing real password
entries, please use release 2.16."
;-) Heh, this is a QC / bug report, not a security advisory! There is
currently no such thing as "PasswordSafe 3.0", and
http://passwordsafe.sourceforge.net/ refers to it as "3.0Beta1". (But yeh,
this is a valid issue and of course should be fixed before the product is
actually released).
> It is possible to mount guaranteed decryption attack on PasswordSafe
> 3.0 databases created under OS prior to Windows XP. The attack is
> very simple:
>
> 1. Generate 256-bit key for every possible seed value
> 2. Decrypt first database record (the structure is documented, so
> we have known plaintext attack)
> 3) Check decrypted value against the known plaintext
>
> The total number of all possible seed values is limited by 2^32, so
> it is quite feasible. Our experiments show that the key can be
> recovered in less than 6 hours on the single PC (Pentium 4).
> Solution/workaround
> ======================================================================
>
> PasswordSafe should not use rand() function; cryptographic RNG should
> be used instead.
I think he should probably pre-pend a random amount of random pad bytes to
the start of the file as well. Help to hide the known plaintext from even
being at a known offset into the ciphertext stream.
cheers,
DaveK
--
Can't think of a witty .sigline today....