Bitwarden PIN protection mechanism

Question

I couldn't find any deep dive info about PIN management in Bitwarden. And I'm not able to read their code, not qualified enough.

Are there people around here who can explain how PIN protection works with Bitwarden browsers extensions?

When the vault is locked and you use your master key to unlock, I am confident no key is stored anywhere on your computer. So I'm fine with this but as my master password is strong it's very inconvenient to type it every time I open my web browser. This is when PIN code enters the scene.

I would like to understand how PIN works since I assume it is used to encrypt the master key stored on your computer. And this could be an issue for some. If it lowers the security level I would appreciate a warning from Bitwarden. So,

1. is the PIN mechanism used to encrypt the masterkey stored on your hard drive?

2. if so, do you know its encryption mechanism? Let's say someone steals the data at rest while my vault is locked, what does that thief need to find the password? Since PIN are way more simple than passwords to make them more convenient, I expect that mechanism to be bruteforce proof. And I'm not talking about the 5 attempts restriction directly in the browser extension, I mean real bruteforce on the stolen raw data.

Answer 1

It derives key Encryption key using 100,000 iterations of PBKDF2_SHA-256 with your email address and PIN as the input. Master key is encrypted by this key.

src/angular/components/lock.component.ts

It is a trade-off for convenience over security. If the encrypted master key is extracted from memory, it can be brute-forced on attacker's machine. Encrypted master key is cleared on browser restart and requires master password to unlock the vault again but this option can be opted out from PIN settings which will cache encrypted master key in persistent storage.