Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I don't understand how KeePass key derivation increases the security of the password db at all. First I'll try to explain what I understood from the key derivation described here. I'll use some pseudo code:

const WORKFACTOR = 6000;

var userKey = UserEnteresPassword();
var userKeyHash = SHA256(userKey);

var randomKey = GetStoredSecureRandomKey();

var tmpKey = userKeyHash;
for(i = 0; i < WORKFACTOR; i++)
{
    tmpKey = AES(tmpKey, randomKey);
}

var finalKey = SHA256(tmpKey);

Then it uses the final finalKey to encrpt the password database. This is then stored on the hard drive.

If I now want to decrypt the password database, why would I have to use this key derivation function? I could simply directly guess the finalKey instead of guessing userKey and having it run though this function. So I would save all the time I would othwise need for this key derivation function.

I am aware that, if I simply guess the finalKey I won't be able to get userKey, but I won't need that since I already have finalKey, I can simply decrypt the password db with. I am not interested in userKey at all.

Or is this completly about dictionary attacks to prevent an attack from using commly known words/passwords and simply see if the db decrypts?

share|improve this question
add comment

3 Answers

up vote 4 down vote accepted

The key derivation is entirely to take the users password and turn it into a 256bit long key to use whatever it's length and hopefully in a secure way.

If running a pure brute-force, yes one could directly guess the key by cycling through all possible patterns that are 256bit long, for this one wants to be sure the key derivation can't narrow the possible key space so all 256bit long keys are still possibilities.

One could try running a dictionary attack and passing all the dictionary words through the key derivation function to generate keys to try one of the points of the key derivation is to make this slow enough that this is not sensible on given hardware.

Now there are some flaws in the pseudo-code you gave depending on a couple of functions (CreateSecureRandomKey() would need to give the same data every time one opens the database to get the same key to use), I'm not sure as I would have to look into key derivation in KeePass myself.

share|improve this answer
    
Changed CreateSecureRandomKey to GetStoredSecureRandomKey to clearify. The secure random key is generated once (and stored plain inside the password db) and can then be recieved. –  GameScripting Sep 5 '12 at 18:33
    
@GameScripting So you mean a salt? –  Tobias Kienzler Feb 5 '13 at 6:23
add comment

This is called key stretching. You can read all about it in the Wikipedia article.

share|improve this answer
    
It's not exactly key streching since the finalyKey can be brute forced without any additional work –  GameScripting Sep 7 '12 at 10:55
2  
@GameScripting It is key-stretching, since brute=forcing 128+ bit key is practically impossible, whereas guessing a password which has perhaps 60 bits of entropy is much easier. –  CodesInChaos Sep 9 '12 at 22:52
    
seen from that perspective, I agree :) –  GameScripting Sep 10 '12 at 8:04
add comment

Look at how difficult it is to brute-force finalKey:

2256 = 2644

264 ~= 4 * 109

You could have four cubic arrays of 1000x1000x1000 processers, running at 4 giga-guesses/sec each, for 125 years, and your chances of guessing it would be a hundred times lower than winning the lottery.

Using a raw password would almost certainly make it easier to brute force. Few people use something like a randomly generated string of 64 hexadecimal digits (64 = 256 / 4) for a regular KeePass password.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.