{"id":2400,"date":"2012-03-20T13:39:45","date_gmt":"2012-03-20T17:39:45","guid":{"rendered":"http:\/\/www.red-sweater.com\/blog\/?p=2400"},"modified":"2012-07-07T12:41:17","modified_gmt":"2012-07-07T16:41:17","slug":"secure-password-storage","status":"publish","type":"post","link":"https:\/\/redsweater.com\/blog\/2400\/secure-password-storage","title":{"rendered":"Secure Password Storage"},"content":{"rendered":"

Tony Arcieri urges developers storing user-sensitive data, such as a passwords, not to use bcrypt<\/a><\/em> (via Michael Tsai<\/a>) for deriving the encryption key:<\/p>\n

The first cipher I’d suggest you consider besides bcrypt is PBKDF2. It’s ubiquitous and time-tested with an academic pedigree from RSA Labs, you know, the guys who invented much of the cryptographic ecosystem we use today.<\/p><\/blockquote>\n

I was a little fuzzy on the distinction between encryption techniques<\/em> such as AES, and the technology being discussed here, which is known as a key derivation function<\/em>. Let’s break it down. With an encryption technique like AES you can use a large (e.g. 128 bits), difficult to guess private key to encrypt and decrypt data. But as a human, you can’t reasonably be expected to type in a random, 128-bit key in by hand when you want to access your data. The key derivation function is the code that takes your relatively<\/em> easily-remembered password and derives a suitably monstrous, unpredictably random key from it. The quality and uncrackability of that key derivation is what Tony is questioning here.<\/p>\n

I don’t know enough about encryption to have my own informed opinion about this. I tend to rely on the collective wisdom of the software industry, or on high-level service providers such as Apple, to suitably safeguard sensitive data in my apps. Tony included Apple’s FileVault full-disk-encryption in the list of technologies that use PBKDF2, which lent the technique an air of superiority in my mind. I know some of the folks behind Apple’s disk encryption, and they are careful, smart engineers. <\/p>\n

I rely on FileVault for protection of my documents. But like most folks, I rely on Apple’s Keychain for the protection of passwords. I’m keenly interested to know if the Keychain is as secure as it reasonably can be, because I store not only my own passwords in it, but also e.g. my users’ blogging passwords in their respective keychains.<\/p>\n

AgileBits, developers of the popular secure-storage app 1Password, made a conscious decision not to use Apple’s Keychain<\/a>. They cite a variety of compelling reasons, including Keychain’s alleged use of a somewhat outdated encryption technique<\/em> called Triple DES. Agile has written extensively<\/a> about the design of their own keychain, in which they confirm that they are using PBKDF2 to derive their encryption keys.<\/p>\n

I’m confident that Apple’s Keychain is secure for all practical purposes<\/em>, but it is just sort of irksome if they are not adopting the very best protection that Mac-money can buy. Unable to find suitably authoritative documentation on the matter, I took to Apple’s open source for libsecurity_keychain, the library through which the Keychain’s data is managed. My reading of the source code<\/a> for a function called SecKeyDeriveFromPassword, does show that Apple is indeed using PBKDF2 to generate the key.<\/p>\n

On 10.7.3 they are, at least. The SecKeyDeriveFromPassword API was new to 10.7, taking over for the older CSSM_DeriveKey. Perhaps the default behavior of that function did not use PBKDF2. In any case, it sure sounds as if on top of Tony’s urging, FileVault’s use, and 1Password’s adoption of PBKDF2, Apple’s decision to use it as the mechanism in their latest versions of the Keychain only adds to the impression that it’s a fine choice.<\/p>\n","protected":false},"excerpt":{"rendered":"

Tony Arcieri urges developers storing user-sensitive data, such as a passwords, not to use bcrypt (via Michael Tsai) for deriving the encryption key: The first cipher I’d suggest you consider besides bcrypt is PBKDF2. It’s ubiquitous and time-tested with an academic pedigree from RSA Labs, you know, the guys who invented much of the cryptographic […]<\/p>\n","protected":false},"author":10,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[14,20,34,66],"tags":[],"class_list":["post-2400","post","type-post","status-publish","format-standard","hentry","category-apple","category-hacking","category-links","category-security"],"_links":{"self":[{"href":"https:\/\/redsweater.com\/blog\/wp-json\/wp\/v2\/posts\/2400","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/redsweater.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/redsweater.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/redsweater.com\/blog\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/redsweater.com\/blog\/wp-json\/wp\/v2\/comments?post=2400"}],"version-history":[{"count":8,"href":"https:\/\/redsweater.com\/blog\/wp-json\/wp\/v2\/posts\/2400\/revisions"}],"predecessor-version":[{"id":2594,"href":"https:\/\/redsweater.com\/blog\/wp-json\/wp\/v2\/posts\/2400\/revisions\/2594"}],"wp:attachment":[{"href":"https:\/\/redsweater.com\/blog\/wp-json\/wp\/v2\/media?parent=2400"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/redsweater.com\/blog\/wp-json\/wp\/v2\/categories?post=2400"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/redsweater.com\/blog\/wp-json\/wp\/v2\/tags?post=2400"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}