Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The LastPass password manager stores One Time Recovery Passwords locally in each browser you use the plugin with:

My question is, how can you have more than one password?

I thought LastPass derived the encryption key from your master password using a variant of PBKDF2 and then encrypted your data with this encryption key locally with AES. There's no room in this scenario for multiple passwords, unless the data is encrypted multiple times. And, how can they enable or disable the OTPs unless they're stored somehow server-side? It just all smells really fishy. If the encryption key for my data never leaves my computer, I cannot understand how any password besides my master password could allow access to my password vault unless there's something LastPass isn't telling us and the local Javascript encryption is all smoke and mirrors...


I contacted LastPass and they pointed me to an explanation here:

share|improve this question
up vote 5 down vote accepted

LastPass stores, on the server, a "vault" which is a collection of data, encrypted with a key derived from the "master password". Let's call K that key. Normally, K is rebuild on the local computer by recomputing it from the master password. However, the same key K could also be stored on the server, this time encrypted with a recovery key Kr, allowing reconstruction of K by whoever knows Kr. The "one-time recovery password stored in the browser" would be that Kr (they call it "password" but the user does not type it, so it can be a fat sequence of random bytes, something usually known as a "key").

With such a system, the vault can expanded with a "recovery blob" which is EKr(K). Generating a recovery blob requires knowledge of K, so it must have happened on the client system, since LastPass does not know the K or the master password. This matches the idea that the one-time recovery password is browser-specific.

If one "recovery blob" can be stored, several recovery blobs can be stored as well. When the user wants to prepare his browser for a potential subsequent recovery, he makes his browser generate a new random Kr, store it in the browser entrails, and compute the recovery blob (the user types his master password, the browser recomputes K and does the encryption with Kr). The recovery blob is then sent to LastPass's servers for storage. At no point does LastPass learn K or the master password or any of the "one-time recovery passwords".

What I describe above is a plausible implementation. I cannot vouch for what LastPass actually does.

A point to make, however, is about "one-time". That one is pure marketing. There is nothing intrinsically "one-time" in what I described. What they mean is that the server will refuse to send back a given recovery blob to the user more than once. Presumably, when a user connects and requests download of a recovery blob, the LastPass server sends it back and then destroys it on its side. This is all relative to how well LastPass complies to this data destruction routine.

(There cannot be anything one-time in a system unless parts of the system enforce some state change which the attacker cannot revert. This is generic.)

share|improve this answer
Ok, sounds about right. Stupid back doors.... Back doors should NOT exist. You only have one password to remember now, come on lol! – John Feb 27 '13 at 17:37
So I contacted LastPass and they pointed me to this explanation here: Which is basically very close to what your wrote. Good guess! – John Mar 7 '13 at 16:24

They could use a system similar to the Linux Unified Key Setup (LUKS), commonly used to encrypt HDD partitions under Linux. LUKS is also usually deployed with PBKDF2 and AES, as in your question.

With LUKS, the data is encrypted under a Master Key, which is then encrypted once for each User Key. User keys are generated from one or more User Passwords, and each stored individually. That way, you can use any of the passwords to yield the master key and decrypt the data.

This is all explained in detail in the 'Overview' section of the pdf linked above.

You can also give different keys to different people and revoke access to individuals without having to change any keys/passwords.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.