Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Keepass is a well known open-source password manager program, with plugin support. One of the offered plugin is a twofish encryption mode of operation in lieu of the build-in AES algorithm (http://keepass.info/plugins.html#twofishcipher).
Since I am fond of the xfish cipher family, I looked at the source of that plugin before using it.
That plugin ( http://gogogadgetscott.info/keepass/twofishcipher/) uses the C# twofish implementation from http://www.codeproject.com/Articles/2593/A-C-implementation-of-the-Twofish-cipher in CBC mode.

In the C# source (file Twofish.cs) , the developer uses a all-zeros Initialization Vector (I am not sure how to relate to the Key zeroing):

    /// <summary>
    /// Generates a random initialization Vector (IV). 
    /// </summary>
    public override void GenerateIV()
    {
        IV = new byte[16]{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
    }

    /// <summary>
    /// Generates a random Key. This is only really useful in testing scenarios.
    /// </summary>
    public override void GenerateKey()
    {
        Key = new byte[KeySize/8];

        // set the array to all 0 - implement a random key generation 
                    // mechanism later probably based on PRNG
        for (int i=Key.GetLowerBound(0);i<Key.GetUpperBound(0);i++)
        {
            Key[i]=0;
        }
    }

Since Keepass is used to encrypt a dynamic set of password records with the same master password, I would assume that this implementation has some major security issues. I would like to solicit comments from the community on the above before I bring my concern up with the developer.

Note: In SUSE Linux 9.2 and below, they also used IV=[0] for their twofish CBC module: "With SUSE LINUX 9.3 we switched from loop_fish2 to twofish as the encryption module. twofish together with cryptoloop is now the standard method for crypto partitions. We made that switch because twofish together with cryptoloop is more secure (cryptoloop uses the block number as the initialization vector, whereas loop_fish2 always uses zero) and is the standard solution for crypto partitions."

share|improve this question
1  
Looking at the code again, I think this actually isn't a problem. I am not familiar with how Keepass handles plugins but I would expect it to pass its own generated key/IV's to the underlying plugin rather than let it generate them itself (see the EncryptStream() method, public and hence exported from the plugin, taking pbKey and pbIV as arguments). In that case the dummy implementations above exist only to satisfy the contract of the C# SymmetricAlgorithm interface. Though it would be better to properly implement them to be able to reuse the Twofish implementation elsewhere.... –  Thomas Aug 23 '13 at 14:28
    
@Thomas - Thank you. I will investigate the code further. –  Ninveh Aug 23 '13 at 17:53
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.