I am currently trying to build a little, secure password manager. As of now, I've implemented the encryption. Each website has its own file and each file has a number of fields (Most commonly username and password). I am using serpent 256 to encrypt the files, and I use a random key (created Crypto.Random in python) that is encrypted using GPG, with a 4k key. Side question: The key is sha256 hashed in order to be able to enter whatever size you want ('cause sha256 always has 256 bit result), do I lose any entropy/security/etc.?

My main question, is how can I securely transfer the decrypted data from my program to, let's say a browser text field or a terminal. I am concerned about keyloggers. So, clipboard is out, virtual typing is out.

I don't know what to google, so search term suggestions are welcome too. I am working on linux (I don't care about other OSes) with python.

The code so far: http://git.dzervas.gr/panman

  • You hash 4k-bit key to 256-bit, and then use that as the key? – domen Dec 23 '14 at 13:32
  • No, I use gpg with a 4k key to decrypt a random 256-bit key and then I hash it. – dzervas Dec 23 '14 at 13:34
  • You use a random x-bit key, which you hash to 256-bit, and then use that? If x > 256, then yes, you lose entropy, if it's < 256, then you don't gain entropy. It seems a lose-lose situation. – domen Dec 23 '14 at 13:36
  • 2
    I'm confuse about your security model: what do you want to protect against with such a system and what do you want to achieve that existing solution cannot do? – Stephane Dec 23 '14 at 13:46
  • @domen the key has to be exactly 256 bit. I use hashing to be able to use bigger passwords. – dzervas Dec 23 '14 at 13:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.