Lastpass: Can we use more rounds of SHA-256 for decryption than user authentication?

Question

I'm new to computer security, there's one question I got confused. The book "Security in Computing" describe that "To protect the master password, the client uses a form of PBKDF2, salting the master password with random data and hashing it by using a large number (5001 by default) of SHA-256 rounds." for user authentication. and it described "The client derives the decryption key from the master password just as it did the login hash, but using one fewer SHA-256 round (5000 rounds instead of 5001)." for database decryption. I wonder if we can change make the opposite. In particular, use 5001 rounds for decryption, but use 5000 rounds for authentication.

Hope someone can help me here, thank you!

Answer 1

I wonder if we can make the opposite. In particular, use 5001 rounds for decryption, but use 5000 rounds for authentication.

No you can't. Since LastPass uses the same salt for both authentication and key derivation, allowing this would be completely insecure.

To authenticate a user, LastPass has to store the authentication hash in its database. Now if the decryption key used more rounds than the password, then an attacker that obtained LastPass's user database could take the hash, perform another round of SHA-256 on it and they would have the decryption key. This would also mean that LastPass itself could decrypt any user's password database any time they wanted (which would violate LastPass's claims that the users' password databases are kept secret even from themselves.)

Answer 2

Yes, the way it's written is really confusing, but it's not.

Let's say the user chooses my-secure-password as the password, and LastPass generates a random salt, say thisIsReallyRandom.

Now LastPass will generate the database encryption key. It will use those values on PBKDF2 and generate this string: D373058D35E38E7B245D3A10A5DDA692D2FEA4368B57CC29AD486C9052B95A2F.

This key will be used to encrypt the database.

It needs to create the user authentication key, akin to a login password. So it will use the same password, the same salt, but instead of using 5000 rounds, it will use 5001, generating this string: 3DFD6AED508F53B887904995683038E41E5B31323653736B96934EFFF30D9F66.

When the user later opens LastPass, it will supply his password(my-secure-password), and LastPass will look at the header of database where the salt and hashed password are stored, grab the salt, and execute PBKDF2 with that salt, the provided password, and 5001 iterations. If the calculated result matches the stored hash, the user is authenticated and can use the database, that is locked.

LastPass now takes the supplied password, the stored hash, and execute PBKDF2 with 5000 rounds this time to generate the database key, and decrypt the database.