I have done some research about password managers and of course stumbled upon LastPass. There are plenty of questions and answers about the security of LastPass, but as far as I am aware none of them talked directly about this specific implementation. When I read this I was quite surprised
LastPass has opted to use SHA-256, a slower hashing algorithm that provides more protection against brute-force attacks. LastPass utilizes the PBKDF2 function implemented with SHA-256 to turn your master password into your encryption key. LastPass performs x number of rounds of the function to create the encryption key, before a single additional round of PBKDF2 is done to create your login hash.
This is how it should work (if understood correctly) according to their Website
- Use PBKDF2 on the Master-Password, with the username as salt
- Iterate at least 5000 times (or higher if configured)
- Master Key is the result of the iterations
- Do one additional round of PBKDF2 and send this to the server for authentication
Server does additional 100.000 rounds of PBKDF2 with a different salt & scrypt with unknown parameter since the security breach
Store and/or compare in/with Database (use HSM for some part here or under 5.)
Send reply to client with vault (encrypted)
Client decrypts with Master Key
While in theory everything is nice and secure, we know LastPass had security breaches in the past. The Master Key is only hashed one more round before being send to LastPast. Assuming that an attacker could potentially get access to LastPass infrastructure and read the values received before step 5.), does this significantly endanger the Master Key?
I would think maybe, but we cannot do a dictionary attack on the key, so the classic attack vector on PBKDF2 does not apply. Unless we have really strong custom hardware, so that we can do a dictionary attack on the master password, despite the 5000 rounds. But on the other hand being just one round away from the Master Key seems a little too close for comfort.
Is there any realistic threat for the Master Key under such circumstances?