Open fladd opened 7 years ago
The line numbers below will be relative to the @804ff9dde70c68591c8010a1816250ea79fcd628 version that is the current tip of the new-features branch, but this code has not changed for a very long time so the numbers should resolve for versions going quite a ways back in time:
The passwordsafe file is written to disk (for the V3 format file) in a procedure in the pwsafe/pwsafe-v3.tcl file which begins on lie 867 of that file.
The routine picks a new salt at line 903 (the procedure pwsafe::int::randomString is defined in pwsafe/pwsafe-int.tcl at line 304 and returns random data from the Issac random number generator that PWGorilla uses.
At line 905 the code recomputes a new stretched key value and at line 906 it hashes that value (the hashed stretched key is the first part of the PWSafe file). Next, at lines 921-924 it retrieves 64 bytes of random data from the random number generator and encrypts those blocks using ecb mode and writes them to the file. Those new random values, newly encrypted, are then written to the file as the B1|B2|B3|B4 referred to in the PWGorilla source, or as K and L in the paper.
Then those newly created K and L values are used to initalize the encryption and hash authentication that is applied to the remainder of the data making up the password file in lines 952+ of the pwsafe-v3.tcl file (a new random IV is also chosen at lines 949-950).
So PWGorilla uses the method that the paper refers to as "less efficient, but secure" because new random K and L values are chosen each time the file is saved to disk.
The save code has been operating in this manner since before the code-base was taken over from Frank P. (PWGorilla's original author). I do not know exactly how long PWGorilla has used this method, but it has been quite a length of time in any case.
Great to hear, thanks a lot for the detailed answer!
Best, Florian
In this paper a specification detail of the psafe3 format is mentioned that opens the door to an attack:
It further mentions how the original Password Safe avoids this:
How is this handled in Password Gorilla?