1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
|
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta http-equiv="expires" content="0" />
<meta http-equiv="cache-control" content="no-cache" />
<meta http-equiv="pragma" content="no-cache" />
<meta name="author" content="Dominik Reichl" />
<meta name="DC.title" content="Security - KeePass" />
<meta name="DC.creator" content="Dominik Reichl" />
<meta name="DC.type" content="Text" />
<meta name="DC.format" content="text/html" />
<meta name="DC.language" content="en" />
<meta name="DC.rights" content="Copyright (C) 2003-2019 Dominik Reichl" />
<meta name="robots" content="index, follow" />
<meta name="flattr:id" content="42rykv" />
<title>Security - KeePass</title>
<base target="_self" />
<link rel="stylesheet" type="text/css" href="../../default.css" />
</head>
<body>
<table class="sectionsummary"><tr><td width="68">
<img src="../images/b64x64_file_locked.png" width="64" height="64"
class="singleimg" align="left" alt="Locked" />
</td><td valign="middle"><h1>Security</h1><br />
Detailed information on the security of KeePass.
</td></tr></table>
<ul>
<li><a href="#secencrypt">Database Encryption</a></li>
<li><a href="#seckeyhash">Key Hashing and Key Derivation</a></li>
<li><a href="#secdictprotect">Protection against Dictionary Attacks</a></li>
<li><a href="#secrandom">Random Number Generation</a></li>
<li><a href="#secmemprot">Process Memory Protection</a></li>
<li><a href="#secdesktop">Enter Master Key on Secure Desktop (Protection against Keyloggers)</a></li>
<li><a href="#seclocking">Locking the Workspace</a></li>
<li><a href="#secattach">Viewing/Editing Attachments</a></li>
<li><a href="#secplugins">Plugins</a></li>
<li><a href="#secselftests">Self-Tests</a></li>
<li><a href="#secspecattacks">Specialized Spyware</a></li>
<li><a href="#secissues">Security Issues</a></li>
</ul>
<br />
<a name="secencrypt"></a>
<h2 class="sectiontitle">
<img src="../images/b16x16_password.png" class="singleimg" alt="Key" /> Database
Encryption</h2>
<p>KeePass database files are encrypted. KeePass encrypts the whole
database, i.e. not only your passwords, but also your user names, URLs,
notes, etc.</p>
<p>The following encryption algorithms are supported:</p>
<p>KeePass 1.x:</p>
<center><table class="tablebox75">
<tr><th align="left" style="width: 64.5%;">Algorithm</th>
<th align="left" style="width: 14%;">Key Size</th>
<th align="left" style="width: 21.5%;">Std. / Ref.</th></tr>
<tr><td align="left">Advanced Encryption Standard (AES / Rijndael)</td>
<td align="left">256 bits</td>
<td align="left"><a href="https://csrc.nist.gov/publications/fips/fips197/fips-197.pdf"
target="_blank">NIST FIPS 197</a></td></tr>
<tr><td align="left">Twofish</td>
<td align="left">256 bits</td>
<td align="left"><a href="https://www.schneier.com/academic/twofish/"
target="_blank">Info</a></td></tr>
</table></center>
<p>KeePass 2.x:</p>
<center><table class="tablebox75">
<tr><th align="left" style="width: 64.5%;">Algorithm</th>
<th align="left" style="width: 14%;">Key Size</th>
<th align="left" style="width: 21.5%;">Std. / Ref.</th></tr>
<tr><td align="left">Advanced Encryption Standard (AES / Rijndael)</td>
<td align="left">256 bits</td>
<td align="left"><a href="https://csrc.nist.gov/publications/fips/fips197/fips-197.pdf"
target="_blank">NIST FIPS 197</a></td></tr>
<tr><td align="left">ChaCha20</td>
<td align="left">256 bits</td>
<td align="left"><a href="https://tools.ietf.org/html/rfc7539"
target="_blank">RFC 7539</a></td></tr>
<tr><td align="left" colspan="3">There exist various
<a href="https://keepass.info/plugins.html" target="_blank">plugins</a>
that provide support for additional encryption algorithms,
including but not limited to Twofish, Serpent and GOST.</td></tr>
</table></center>
<p>These well-known and thoroughly analyzed algorithms are
considered to be very secure.
AES (Rijndael) became effective as a U.S. federal government standard
and is approved by the National Security Agency (NSA)
for top secret information.
Twofish was one of the other four AES finalists.
ChaCha20 is the successor of the Salsa20 algorithm (which is included in the
<a href="http://www.ecrypt.eu.org/stream/"
target="_blank">eSTREAM portfolio</a>).</p>
<p>The block ciphers are used in the Cipher Block Chaining (CBC)
<a href="https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation"
target="_blank">block cipher mode</a>.
In CBC mode, plaintext patterns are concealed.</p>
<p>An <a href="https://en.wikipedia.org/wiki/Initialization_vector"
target="_blank">initialization vector</a> (IV) is generated
<a href="#secrandom">randomly</a> each time
a database is saved. Thus, multiple databases encrypted with the same
master key (e.g. backups) are no problem.</p>
<p>Data authenticity and integrity:</p>
The authenticity and integrity of the data is ensured using
a HMAC-SHA-256 hash of the ciphertext (Encrypt-then-MAC scheme).
<br />
<br /><br />
<a name="seckeyhash"></a>
<h2 class="sectiontitle">
<img src="../images/b16x16_password.png" class="singleimg" alt="Key" /> Key
Hashing and Key Derivation</h2>
<p>SHA-256 is used for compressing the components
of the <a href="keys.html">composite master key</a>
(consisting of a password, a key file, a Windows user account key
and/or a key provided by a plugin) to a 256-bit key <em>K</em>.</p>
<p>SHA-256 is a cryptographic hash function that is considered to be
very secure. It <!-- has been designed by the National Security Agency (NSA),
and -->has been standardized in
<a href="https://dx.doi.org/10.6028/NIST.FIPS.180-4"
target="_blank">NIST FIPS 180-4</a>.
The <a href="https://www.schneier.com/blog/archives/2005/02/cryptanalysis_o.html"
target="_blank">attack against SHA-1</a> discovered in 2005 does not affect
the security of SHA-256.</p>
<p>In order to generate the key for the encryption algorithm,
<em>K</em> is transformed using a key derivation function (with
a random salt). This prevents precomputation of keys and makes dictionary
and guessing attacks harder. For details, see the section
'<a href="#secdictprotect">Protection against Dictionary Attacks</a>'.</p>
<br />
<a name="secdictprotect"></a>
<h2 class="sectiontitle">
<img src="../images/b16x16_password.png" class="singleimg" alt="Key" /> Protection
against Dictionary Attacks</h2>
<p>KeePass features a protection against dictionary and guessing attacks.</p>
<p>Such attacks cannot be prevented, but they can be made harder.
For this, the key <em>K</em> derived from the user's composite master key
(see <a href="#seckeyhash">above</a>) is transformed using a
key derivation function with a random salt.
This prevents a precomputation of keys and adds a work factor
that the user can make as large as desired
to increase the computational effort of a dictionary or guessing attack.</p>
<p>The following key derivation functions are supported
(they can be chosen and configured in the database settings dialog):</p>
<ul class="withspc">
<li><strong>AES-KDF</strong> (KeePass 1.x and 2.x):<br />
This key derivation function is based on iterating
AES.<!-- This key derivation function splits <em>K</em> into two 128-bit halves
(the block size of AES is 128 bits) and iteratively encrypts them
using AES with a random 256-bit key (transformation salt).
The key derivation is finalized using one SHA-256 computation
that combines the two halves. --><br />
<small><br /></small>
In the database settings dialog, users can change the number of
iterations. The more iterations, the harder are dictionary and guessing
attacks, but also database loading/saving takes more time (linearly).<br />
<small><br /></small>
On Windows Vista and higher, KeePass can use Windows' CNG/BCrypt API
for the key transformation, which is about 50% faster than the
key transformation code built-in to KeePass.</li>
<li><strong>Argon2</strong> (KeePass 2.x only):<br />
<a href="https://github.com/p-h-c/phc-winner-argon2#argon2" target="_blank">Argon2</a>
is the winner of the <a href="https://password-hashing.net/"
target="_blank">Password Hashing Competition</a>.
The main advantage of Argon2 over AES-KDF is that it provides a better
resistance against GPU/ASIC attacks
(due to being a memory-hard function).<br />
<small><br /></small>
The number of iterations scales linearly with the required time.
By increasing the memory parameter, GPU/ASIC attacks become
harder (and the required time increases).
The parallelism parameter can be used to specify how many threads
should be used.</li>
<!-- <li><strong>Plugins</strong> (KeePass 2.x only):<br />
<a href="https://keepass.info/plugins.html" target="_blank">Plugins</a>
can provide additional key derivation functions.</li> -->
</ul>
<p>By clicking the '1 Second Delay' button in the database settings
dialog, KeePass computes the number of iterations that results in a
1 second delay when loading/saving a database.
Furthermore, KeePass 2.x has a button 'Test' that performs a key
derivation with the specified parameters (which can be cancelled)
and reports the required time.</p>
<p>The key derivation may require more or less time on other
devices. If you are using KeePass or a port of it on other devices,
make sure that all devices are fast enough (and have sufficient memory)
to load the database with your parameters within an acceptable time.</p>
<p><strong>KeePassX.</strong> In contrast to KeePass, the Linux port KeePassX
only partially supports protection against dictionary and guessing attacks.</p>
<br />
<a name="secrandom"></a>
<h2 class="sectiontitle">
<img src="../images/b16x16_binary.png" class="singleimg" alt="Binary" /> Random
Number Generation</h2>
<p>KeePass first creates an entropy pool using various entropy sources
(including random numbers generated by the system cryptographic provider,
current date/time and uptime, cursor position, operating system version,
processor count, environment variables, process and memory statistics,
current culture, a new random GUID, etc.).</p>
<p>The random bits for the high-level generation methods are generated
using a cryptographically secure pseudo-random number generator
(based on SHA-256/SHA-512 and ChaCha20) that is initialized using the entropy pool.</p>
<br />
<a name="secmemprot"></a>
<h2 class="sectiontitle">
<img src="../images/b16x16_file_locked.png" class="singleimg"
alt="Application Protection" /> Process Memory Protection</h2>
<p>While KeePass is running, sensitive data (like the hash of the master key
and entry passwords) is stored encryptedly in process memory.
This means that even if you would dump the KeePass process memory to disk,
you could not find any sensitive data.</p>
<p>Furthermore, KeePass erases all security-critical memory when it is not
needed anymore, i.e. it overwrites these memory areas before releasing them.</p>
<p>KeePass uses the Windows DPAPI for encrypting sensitive data in memory
(via <a href="https://msdn.microsoft.com/en-us/library/windows/desktop/aa380262.aspx"
target="_blank">CryptProtectMemory</a> /
<a href="https://msdn.microsoft.com/en-us/library/system.security.cryptography.protectedmemory.aspx"
target="_blank">ProtectedMemory</a>).
With DPAPI, the key for the memory encryption is stored in a
secure, non-swappable memory area managed by Windows.
DPAPI is available on Windows 2000 and higher.
KeePass 2.x always uses DPAPI when it is available;
in KeePass 1.x, this can be disabled (in the advanced options; by default
using DPAPI is enabled; if it is disabled, KeePass 1.x uses the ARC4 encryption
algorithm with a random key; note that this is less secure than DPAPI, mainly <i>not</i>
because ARC4 cryptographically is not that strong, but because the key for
the memory encryption is also stored in swappable process memory;
similarly, KeePass 2.x falls back to encrypting the process memory using
ChaCha20, if DPAPI is unavailable).
On Unix-like systems, KeePass 2.x uses ChaCha20, because Mono does not provide
any effective memory protection method.</p>
<p>For some operations, KeePass must make sensitive data available
unencryptedly in process memory. For example, in order to show a password
in the standard list view control provided by Windows, KeePass must supply
the cell content (the password) as unencrypted string
(unless hiding using asterisks is enabled).
Operations that result in unencrypted data in process memory include,
but are not limited to: displaying data (not asterisks) in standard controls,
searching data, and replacing placeholders (during auto-type, drag&drop,
copying to clipboard, ...).
Windows may make an internal copy of the data (in process memory)
that cannot be erased by KeePass.</p>
<br />
<a name="secdesktop"></a>
<h2 class="sectiontitle">
<img src="../images/b16x16_kgpg.png" class="singleimg" alt="User Key" /> Enter
Master Key on Secure Desktop (Protection against Keyloggers)</h2>
<p>KeePass 2.x has an option (in 'Tools' → 'Options' → tab 'Security')
to show the master key dialog on a different/secure desktop
(supported on Windows 2000 and higher), similar to Windows'
User Account Control (UAC). Almost no keylogger works on a secure desktop.</p>
<p>The option is turned off by default for compatibility reasons.</p>
<p>More information can be found on the
<a href="https://keepass.info/help/kb/sec_desk.html" target="_blank">Secure Desktop</a>
help page.</p>
Note that auto-type can be secured against keyloggers, too, by using
<a href="../v2/autotype_obfuscation.html">Two-Channel Auto-Type Obfuscation</a>.
<p><i>Note: KeePass was one of the first password managers that allow
entering the master key on a different/secure desktop!</i></p>
<br />
<a name="seclocking"></a>
<h2 class="sectiontitle">
<img src="../images/b16x16_file_locked.png" class="singleimg"
alt="Application Protection" /> Locking the Workspace</h2>
<p>When locking the workspace, KeePass closes the database file and
only remembers its path.</p>
<p>This provides maximum security: unlocking the
workspace is as hard as opening the database file the normal way. Also, it prevents
data loss (the computer can crash while KeePass is locked, without doing any damage
to the database).</p>
<br />
<a name="secattach"></a>
<h2 class="sectiontitle">
<img src="../images/b16x16_desktop.png" class="singleimg" alt="Desktop" /> Viewing/Editing
Attachments</h2>
<p>KeePass 2.x has an internal viewer/editor for attachments.
For details how to use it for working with texts, see
'<a href="faq_tech.html#rtftext">How to store and work with large amounts of
(formatted) text?</a>'.</p>
<p>The internal viewer/editor works with the data in main memory.
It does not extract/store the data onto disk.</p>
<p>When trying to open an attachment that the internal viewer/editor cannot handle
(e.g. a PDF file), KeePass extracts the attachment to a (EFS-encrypted)
temporary file and opens it using the default application associated with this file type.
After finishing viewing/editing, the user can choose between importing
or discarding any changes made to the temporary file.
In any case, KeePass afterwards securely deletes the temporary file
(including overwriting it).</p>
<br />
<a name="secplugins"></a>
<h2 class="sectiontitle">
<img src="../images/b16x16_blockdevice.png" class="singleimg" alt="Plugins" /> Plugins</h2>
<p>A separate page exist about the security of plugins:
<a href="../v2/plugins.html">Plugin Security</a>.</p>
<br />
<a name="secselftests"></a>
<h2 class="sectiontitle">
<img src="../images/b16x16_kblackbox.png" class="singleimg" alt="Black Box" /> Self-Tests</h2>
<p>Each time you start KeePass, the program performs a quick self-test to see
whether the encryption and hash algorithms work correctly and pass
their test vectors. If one of the algorithms does not pass its test vectors,
KeePass shows a security exception dialog.</p>
<br />
<a name="secspecattacks"></a>
<h2 class="sectiontitle">
<img src="../images/b16x16_openterm.png" class="singleimg" alt="Terminal" /> Specialized
Spyware</h2>
<p>This section gives answers to questions like the following:</p>
<ul>
<li>Would encrypting the configuration file increase security by preventing
changes by a malicious program?</li>
<li>Would encrypting the application (executable file, eventually together
with the configuration file) increase security by preventing changes
by a malicious program?</li>
<li>Would an option to prevent plugins from being loaded increase security?</li>
<li>Would storing security options in the database (to override the settings of
the KeePass instance) increase security?</li>
<li>Would locking the main window in such a way that only auto-type is allowed
increase security?</li>
</ul>
<p>The answer to all these questions is: no. Adding any of these features
would not increase security.</p>
<p>All security features in KeePass protect against <em>generic</em> threats like
keyloggers, clipboard monitors, password control monitors, etc. (and against
non-runtime attacks on the database, memory dump analyzers, ...).
However in all the questions above we are assuming that there is a spyware
program running on the system that is specialized on attacking KeePass.</p>
<p>In this situation, the best security features will fail.
This is law #1 of the
<!-- https://technet.microsoft.com/en-us/library/cc722487.aspx -->
<a href="https://technet.microsoft.com/en-us/library/hh278941.aspx"
target="_blank">Ten Immutable Laws of Security</a>
(Microsoft TechNet article; see also the
Microsoft TechNet article
<a href="https://technet.microsoft.com/en-us/library/2008.10.securitywatch.aspx"
target="_blank">Revisiting the 10 Immutable Laws of Security, Part 1</a>):<br />
<i>"If a bad guy can persuade you to run his program on your
computer, it's not your computer anymore"</i>.</p>
<p>For example, consider the following very simple spyware specialized
for KeePass: an application that waits for KeePass to be started, then hides
the started application and imitates KeePass itself. All interactions
(like entering a password for decrypting the configuration, etc.) can be
simulated.
The only way to discover this spyware is to use a program that the spyware
does not know about or cannot manipulate (secure desktop);
in any case it cannot be KeePass.</p>
<p>For protecting your PC, we recommend using an anti-virus software.
Use a proper firewall, only run software from trusted sources,
do not open unknown e-mail attachments, etc.</p>
<br />
<a name="secissues"></a>
<h2 class="sectiontitle">
<img src="../images/b16x16_message.png" class="singleimg" alt="Message" /> Security
Issues</h2>
<p>For a list of security issues, their status and clarifications, please see the page
<a href="https://keepass.info/help/kb/sec_issues.html"
target="_blank">Security Issues</a>.</p>
</body></html>
|
