Key-Derivation

[karheinz]

Hi!

Is it correct, that the encryption-key is derived from the password by this method (CipherUtils)?

public static String getKey(String password) throws NoSuchAlgorithmException {
    for (int i = 0; i < 1000; ++i) {
        password = SHA256(password);
    }
   return password.substring(0, 16);
}

This is bad! You should use at least PBKDF2 with a high number of iterations.

[ehsun7b]

Hi, no it is not correct.
By the way are us asking about MyPasswords 2.x or MyPasswords 3.0?

Ehsun Behravesh
http://www.ehsunbehravesh.com
http://ehsun7b.blogspot.com
http://www.google.com/profiles/ehsun7b

On Mon, Apr 6, 2015 at 4:33 AM, karheinz notifications@github.com wrote:

Hi!

Is it correct, that the encryption-key is derived from the password by
this method (CipherUtils)?

public static String getKey(String password) throws NoSuchAlgorithmException {
for (int i = 0; i < 1000; ++i) {
password = SHA256(password);
}
return password.substring(0, 16);
}

This is bad! You should use at least PBKDF2 with a high number of
iterations.

—
Reply to this email directly or view it on GitHub
#11.

[ehsun7b]

MyPasswords 3.0 key derivation is not done yet. It will be implemented in a native code. In case you are asking about MyPasswords 2.0 which is not hosted here, it is not the case for key derivation.

[karheinz]

What is meant with native code?

I took a look at MyPasswords 2.* and its worse there. The AES-key here is build out of the first 8 byte of the password:

AES-key = 16 byte = (first 8 byte of the password) | (first 8 byte of the password)

[ehsun7b]

native code means in a native dynamic library, so it can not be decompiled. a .dll/.so/dylib file.

Yes in MyPasswords 2.x it was like that, but it will not be the same in MyPasswords 3.0

[karheinz]

Keeping the algorithm secret does not lead to more security. "The enemy knows the system."

http://en.wikipedia.org/wiki/Kerckhoffs%27s_principle

Btw, memory can be disassambled (e. g. with GDB). Somebody will do this, for sure.

[ehsun7b]

you are right, but as I said earlier, MyPasswords 3.0 is not ready and key derivation part is a prototype yet, it is not implemented yet. Please report bugs after the release ;) MyPasswords 3.0 is not released yet.
Thanks for your time