4

Background information: Master password is a stateless password manager. It (deterministically) generates a password using a hash function, depending on your master password and the site name (also some other fields, but these aren't important for this question).

So if you remember your master password and the site name (and some small details) than you can generate the password for your site's account everytime, without storing passwords (encrypted or not) somewhere on your computer (which needs backups) or in the cloud (which means you need to trust an additional third party).

It generates a password in two parts:

  • Part 1: scrypt_key = scrypt(password + some salts + other details).
  • Part 2: sha256(scrypt_key + site name + other details).

This last part is then used (pretty printed, not binary) for a site's password.

For the detailed version, see the page on the algorithm: http://masterpasswordapp.com/algorithm.html.

My actual question is then: What are the consequences of using sha rather than scrypt for the second part? They obviously know of the existence of scrypt, so why didn't they use it for the second part as well?

The only reason that I can think of why using sha for the second part is that if an attacker finds a collision, then the found collision is probably not the one he needs (e.g. sha256("abcdef") accidentally equals sha256(scrypt_key + ...)).

|improve this question|||||
2

Slow key-derivation functions like SCrypt, BCrypt or PBKDF2 are necessary, to protect relatively short and weak passwords, or to generate a key from such passwords (Password-Based-Key-Derivation-Function). Users need to remember their passwords, so they are typically not very strong, that's why SCrypt was choosen to hash the user password.

On the other side, hashing with a fast SHA-256 is absolutely safe for very strong "passwords". The key generated with SCrypt is such a strong password/key, so there is no reason to use SCrypt again.

Eventually it must be decided how much time can be spent to calculate the hash, lets say you are willing to spend 1 second of CPU power. It is a good decision to spend as much time as possible for the first SCrypt hash, and only few time for the second hash. Otherwise you would weaken the SCrypt hash, because you wasted time for the second hash.

|improve this answer|||||
0

scrypt needs much more power than SHA2 as it needs computing power and memory. The master key is protected using scrypt because it is much slower. But the passwords for the websites are hashed using the strong scrypt key but this time SHA256 is used because it is faster. The scrypt key is used for the hash and builds a strong base for the hash.

Hashing the website passwords with scrypt again using the scrypt key might take just too long which is not necessary here.

The second part is for making hardware bruteforce attacks harder but getting a good performance and security at the same time.

|improve this answer|||||
  • script is a hash function right? This password manager doesn't actually encrypt (let alone decrypt) anything, it generates the passwords for the websites (deterministally) on demand. Or am I completely missing the point now? (alright, the password manager seems to have some backup AES encryption if a user-chosen password is nescessary, but it prefers never to use that and that's besides the point of this question). – Matty Nov 13 '15 at 17:33
  • Updated my answer with information about the specific usage in this password manager and why they do it this way. – Daniel Ruf Nov 13 '15 at 17:58
  • Well, yes, it will speed things up and yes, scrypt is relatively slow. But you only have to calculate two of them. I don't want to calculate millions of scrypt hashes, sure, but two, why not? – Matty Nov 13 '15 at 18:26
  • There is just one scrypt hash from the master key which is used for the seed which uses SHA256. It is just used as additional salt parameter to make bruteforce attacks harder. – Daniel Ruf Nov 13 '15 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.