Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Password Safe and Password Gorilla are both programs to manage passwords. Both store a list of user passwords in a file, which is encrypted using a master password. They use the same file format, so you can alternate between the two, using the same file, as Joel Spolsky recommended.

Password Safe was created by Bruce Schneier, who said the following about it:

Password Safe protects passwords with the Twofish encryption algorithm, a fast, free alternative to DES.

Although I respect Schneier, the "fast" encryption part gives me pause. I want it to be very difficult to brute force my password file, so I want the decryption be relatively slow.

I think that Password Safe now supports something like the work factor of bcrypt, but if I'm going to use the Spolsky method of sharing my file between computers with Dropbox, I want to be very sure that, if it fell into the wrong hands, nobody would be able to brute force it.

Assuming I've chosen a complex password, how secure is the encryption on these files?

share|improve this question

5 Answers 5

By fast, they mean once you've set up a decryption key (e.g., entered your passphrase), you can decrypt a large or small file very quickly. The time necessary to check a single passphrase of twofish and DES are both similar (see time/cycles to set up key and IV - initialization vector):

(these are benchmarks for encryption; but should be similar).

Wikipedia lists some progress on attacks of twofish, but concludes by quotes the first author of the a decades old published partial attack:

"But even from a theoretical perspective, Twofish isn't even remotely broken. There have been no extensions to these results since they were published in 2000".

However, you mention you have a complex password. You probably should be using a passphrase. Eight random characters (upper/lowercase + numbers) ~ 247 ~ 1014? The quoted benchmark may take ~10 microseconds (10-5 s) to try one password; so you could try 10^14 passwords in a 109 s ~ 100 years of CPU time; which is in the realm of feasibility for say gov't to eventually break. If you had say a 6 word diceware passphrase (77 bits of entropy) it would take 100 billion years of today's CPU time to break.

share|improve this answer

When doing encryption while using a password as key, there are two phases:

  1. The password is transformed into a key suitable for the symmetric encryption algorithm which is to be used.
  2. The encryption algorithm is applied to whatever data is to be encrypted.

Salts and configurable slowness, the two mantras of good password processing, are to be applied on step 1, not step 2. If the encryption was inherently slow, then it would be very slow for you, because encryption time is proportional to the size of the data to encrypt or decrypt. On the other hand, the attacker only has to decrypt the first block or so to quickly rule out wrong passwords.

In other words, if the encryption itself was slow, you would not be able to make it as sow as you would wish, and the attacker would not be much thwarted. When doing the slowness in the password hashing step, on the other hand, you can make things more equal between you and the attacker. I have not looked what Password Safe employs for that step, but usual recommendations are bcrypt and PBKDF2.

In practice, the encryption speed is not important. 3DES is "slow" which means that decrypting all your stored password would take 500 microseconds instead of 50 with a faster algorithm -- but you would not see the difference anyway. Scheneier's banter about speed of Twofish is just an old piece of commercial advertisement which made sense 15 years ago when Twofish was involved in the AES competition (but, ultimately, Rijndael won and became "the AES").

share|improve this answer
Thanks for the clarification between slowness on #1 and #2. A very enlightening answer! – Nathan Long Feb 6 '13 at 14:55

I don't know of any independent assessment of Password Safe and its security. However the fact that the program's source code is open is of some comfort when it comes to hidden backdoors, "calling home" behavior etc.

Until a comprehensive and independent analysis is available, I would keep my Password Safe file wrapped inside a TrueCrypt file container. That way, potential vulnerabilities in the Password Safe implementation should be a lesser problem.

share|improve this answer
see my answer for an "independent assessment," please. Thx. – Yar Aug 6 at 15:37

Most attacks discussed in other answers are brute force attacks which guess the password. That aside, it has been verified:

Password Safe protects passwords with the Twofish encryption algorithm, a fast, free alternative to DES. The program's security has been thoroughly verified by Counterpane Labs under the supervision of Bruce Schneier, author of Applied Cryptography and creator of the Twofish algorithm.

But are you using Password Safe or a port, like this one for Mac? If you are, then here's the bad news from Schneier from Counterpane

Various third-party ports, clones, and readers are also available. I haven't looked at any of these programs, and can't vouch for their compatibility or their security.

So the answer is "very."

share|improve this answer

Encryption isn't the concern with these scenarios. Security isn't just about encryption. Hardware changes and allows faster cracks, access to a file can allow deconstruction in some circumstances. Most people who get access to your file will likely not try to crack it at all, unless you're someplace like a convention for people who crack things.

With good local password managers, this ultimately comes down to the physical security of the file, the passphrase you choose to lock it, and how you store that passphrase.

Once a file has been copied out of your control, it is only a matter of time before the file is cracked. Especially if you use similar passwords across your accounts and any of those passwords have been compromised. An example might be locking the file with your Facebook password.

If you opt for anything simple (fewer than 10 characters) in regard to a key, and guessing the phrase using a dictionary attack built off of you on a profile could be cracked within a couple of days for someone who knows you or is really good at building profiles if you randomize characters. If you don't, it could be a couple of hours. If you choose something completely random, like an SHA1 hash for a password, you'll likely not remember it, and in this case, that password will be stored somewhere else, either in a text file on a phone or another easily accessible device. Ideally somewhere like in a fireproof safe would be ideal. If you do use a hash for a password you can always recreate the hash by hashing the phrase you used again. If you're known to do this, then good crackers will attempt cycles of your own personal dictionary through a pattern of hashes to make a custom rainbow table. This can come down to social engineering and whether you've told anyone about your "mad skillz." I overhead an employee bragging about their use of this very method and got their password in 15 attempts.

If you store the password in something like the Mac Keychain list (if you're on an Apple computer), the attacker only needs to capture your user password or use an app to steal it. There are often ways to do this sort of thing.

Otherwise it becomes a matter of convenience in regard to cracking your own password to get back into the password list if you manage to misplace the password or if you forget it altogether.

If you delete all of your other records of your passwords and store them exclusively in this file, now if you do happen to lose the password, it's really secure because nobody knows the password. I can attest to this account, as I myself have been barraging a 256-bit encrypted DMG where the password was misplaced for over the last few days for a client. It could take weeks in this case and we have a 1000 word dictionary of core possibilities.

The local password managers however are likely safer as they require access to your encrypted file, whereas in regard to remote password managers the network connections and encryption methods being used throughout the chain have to be solid with no chance of a man-in-the-middle attack.

If you use a local password manager and lose the file, corrupt it, or lose a drive you have no way to recover if you do not have a backup. Physical security of this backup is important if it contains your password file. Why an attacker go to the trouble of trying to get into your Windows machine if they could clone your external backup drive and access the files at their leisure? You'll want to make sure these backups are encrypted as well.

All of these come down to whether you really are a target or not, for most people it would have to be a personal attack for someone to want into their social media accounts this badly.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.