Triple DES in Firefox - in practice

Reading about triple DES and understanding the principles, I am still curious how Firefox defines their three keys for the encryption/decryption. Suppose that the user saves his passwords in the browser without a master key, are the default keys randomized and saved to the separate file? Also, if the user enters a master key for the encryption, which of the three keys will the master key be and why?

I'm a developer myself and technical details in a programming sense would be greatly appreciated.

I've been fooling around with a helper I found for cracking passwords in FF and added it to my program, but it really bugs me that I have no real knowledge what is going on.

Thanks, please don't flame me too much!

• Do you have any references we can look at. I have no idea how/where firefox uses 3DES. – mikeazo Oct 1 '14 at 15:42
• We don't flame. We downvote. – rath Oct 2 '14 at 22:40

I assume you are asking how the password a user enters to unlock their saved user data is translated into the keys used by 3DES? According to this link DES-EDE-CBC, which is only two-key 3DES. The first and third keys are set equal to each other, resulting in two keys of 56 bits or a total size of 112 bits.

To get that key material from a password, a Password Based Key Derivation Function (PBKDF) is usually used. The details differ depending on the algorithm, but the key idea is to take the password and run it (one or more times) through a cryptographically secure hash function, which has a fixed size output. The output is usually longer than what you need, so you just take the first $k$ bits to make a key of size $k$.

Again accoring to the link, Firefox appears to use a SHA1 HMAC with a random salt as the key. This would output 160 bits, of which you only need 112.

If the user does not set a master password, then the password is actually blank, but with a random salt. That is equivalent to what you said, i.e. having a random key saved to a file.

• In general your description on how to generate a key from a password is correct, but the answer seems otherwise made up of assumptions instead of knowledge or references. – Maarten Bodewes Oct 1 '14 at 23:31
• Okay I had some time so I looked it up. – Travis Mayberry Oct 2 '14 at 0:22