-
Notifications
You must be signed in to change notification settings - Fork 2
Crypto
This doc will outline how Bitwarden handles encryption for its vault.
All password managers encrypt the vault with a Master Password. Bitwarden uses the Master Password to create a Master Key (for encrypting and decrypting the Vault).
Using the Master Key, Bitwarden creates a Master Password Hash (for networking auth stuff) and a Stretched Master Key.
Usually the Master Key is created from the Master Password using PBKDF2-SHA256 salted with the user's email with 600,000 Iterations by default. However, Bitwarden also supports Argon2ID which is said to be superior.
Argon2Id is a memory-hard KDF that is designed to combat time-memory trade off attacks as well as side-channel attacks.
PBKDF2-SHA256 is a KDF that applies a HMAC to a password as well as a salt (usually the email) and repeats the process multiple times (usually 600,000 iterations) to create a derived key.
Once a derived key is created, it is then stretched into a Stretched Master key which gets split up into an Encryption Key and a Mac Key. The Enc Key and Mac Key is then used to decrypt the Symmetric Key which also gets split up into an Enc Key and Mac Key. The Enc Key and Mac Key from the Symmetric Key is then used to decrypt and encrypt items.
Each Cipher (also called Item) has its own key which gets split up into the Cipher's Enc and Mac Key.
First, the Cipher's key gets verified using the Mac Key and then decrypted using the Enc Key. The decrypted cipher key is then split up into the Cipher's Enc Key and Mac Key, which is then used to decrypt individual values in the Cipher, like the Name field or UserName field.
VaultWarden and older versions of BitWarden keep the key field in the cipher as null. If the key field is null, then the cipher hasn't been individually encrypted and must be decrypted using the vault's Enc Key and Mac Key.
Attachments contain the Attachment Body and the Attachment Name.
The Attachment Name is encrypted by the Cipher's own Enc and Mac Keys.
The attachment also contains its own Attachment Key which is encrypted by the Cipher's own Enc and Mac Keys, which is then used to encrypt the Attachment Body.