Title : PasswordSafe 3.0 weak random number generator allows key
recovery attack
Date : March 23, 2006
Product : PasswordSafe 3.0
Discovered by : ElcomSoft Co.Ltd.
Overview
==
PasswordSafe is a program originally written by security expert
Bruce Schneier (http://www.schneier.com) that allows one to store
users' passwords in single file (called safe) which is
encrypted and protected by user's master password (called Safe
Combination) with the Blowfish encryption algorithm. As noted on
PasswordSafe web page, the program's security has been thoroughly
verified by Counterpane Labs under the supervision of Bruce Schneier,
author of Applied Cryptography and creator of the Blowfish algorithm.
As noted in Password Safe FAQ, there is no back door in
PasswordSafe to recover your Safe Combination, but there is a
password-guessing program that some people have used successfully.
The program works by going through a list of possible passwords
and checking each one.
Version 3.0 introduces new password database format which
(theoretically) eliminates security flaw found by ElcomSoft Co. Ltd.
in November 2005, and does not allow an attacker to bypass key
stretching algorithm any more.
However, there is even more serious security flaw in version 3.0,
which allows to recover 256-bit database encryption key in a
reasonable time (under certain conditions). And with the recovered
encryption key, it is to decrypt all database records (logins,
passwords, etc) without the master password (so-called Safe
Combination).
Details
==
PasswordSafe 3.0 utilizes two different random number generator (RNG)
functions: Win32 API RtlGenRandom() and standart Visual C++ rand().
RtlGenRandom() is not available on Windows prior to Windows XP (i.e.
Windows 2000, Windows NT, Windows Me) so rand() is used instead.
Specifically, rand() is used to generate 256-bit database encryption
key. It is widely known that using rand() in cryptographic
applications is not secure due to its predictbility and small
internal state.
It is possible to mount guaranteed decryption attack on PasswordSafe
3.0 databases created under OS prior to Windows XP. The attack is
very simple:
1. Generate 256-bit key for every possible seed value
2. Decrypt first database record (the structure is documented, so
we have known plaintext attack)
3) Check decrypted value against the known plaintext
The total number of all possible seed values is limited by 2^32, so
it is quite feasible. Our experiments show that the key can be
recovered in less than 6 hours on the single PC (Pentium 4).
Impact
==
PasswordSafe is used to store sensitive data, and so the presence
of such flaws may help attacker to disclose user's logins,
passwords and PINs by implementing efficient key recovery attacks.
Solution/workaround
==
PasswordSafe should not use rand() function; cryptographic RNG should
be used instead.
References
==
Bruce Schneier - Password Safe
http://www.schneier.com/passsafe.html
Password Safe - Project Info
http://passwordsafe.sourceforge.net/
Password Safe FAQ
http://www.schneier.com/passsafe-faq.html
BugTraq: Schneier's PasswordSafe password validation flaw
http://www.securityfocus.com/archive/1/416873/30/0/threaded
About ElcomSoft Co.Ltd.
==
Since 1990, ElcomSoft Co.Ltd. (http://www.elcomsoft.com) has been
developing and marketing password recovery, forensics, and security
software for Windows. The company offers a comprehensive line of
password recovery software for more than 80 popular file and document
types, email clients, compression programs, instant messengers, and
other applications. ElcomSoft tools are used by most of the
Fortune 500 corporations, many branches of the military all over the
world, foreign governments, and all major accounting companies.
