bitwarden / clients

Bitwarden client apps (web, browser extension, desktop, and cli).
https://bitwarden.com
Other
8.68k stars 1.14k forks source link

KDF form doesn't load current KDF iterations value when toggling algorithm #4978

Open bwbug opened 1 year ago

bwbug commented 1 year ago

Steps To Reproduce

  1. Have KDF algorithm set to PBKDF2 with a nondefault value of KDF iterations.
  2. Log in to web vault, and go to Encryption Key Settings page.
  3. Observe the value shown in the KDF iterations field.
  4. Change the KDF algorithm dropdown value from PBKDF2 SHA-256 to Argon2id.
  5. Change the KDF algorithm dropdown value from Argon2id back to PBKDF2 SHA-256.
  6. Observe the value shown in the KDF iterations field.

Expected Result

The number of KDF iterations observed in Step 6 should match the number of KDF iterations observed in Step 2.

Actual Result

The number of KDF iterations observed in Step 6 does not match the number of KDF iterations observed in Step 2. In Step 6, the value shown is 600000 (i.e., the default value for new accounts) instead of the current KDF iterations value (which was never changed in the procedure above).

Screenshots or Videos

No response

Additional Context

This is just an issue with how the form field values are loaded. The actual number of KDF iterations has not been modified by the process described above (this can be verified by clicking the Master Password tab and then returning to the Keys tab, which will load the currently stored value of the KDF iterations).

I have not checked whether the same issue occurs if one is using Argon2id with nondefault settings, then visits the Encryption Key Settings form and toggles the KDF algorithm to PBKDF2 and back to Argon2id.

Operating System

Windows

Operating System Version

10 (20H2)

Web Browser

Chrome

Browser Version

111.0.5563.64

Build Version

2023.2.0

Issue Tracking Info

SergeantConfused commented 1 year ago

Hi @bwbug,

Thank you for your report. I was able to reproduce this behaviour and have flagged it internally to our engineering team.

Please feel free to post any additional details and/or screenshots, if you wish, because we'll review those.

Thank you again,