# Triple DES in Firefox - in practice

Reading about triple DES and understanding the principles, I am still curious how Firefox defines their three keys for the encryption/decryption. Suppose that the user saves his passwords in the browser without a master key, are the default keys randomized and saved to the separate file? Also, if the user enters a master key for the encryption, which of the three keys will the master key be and why?

I'm a developer myself and technical details in a programming sense would be greatly appreciated.

I've been fooling around with a helper I found for cracking passwords in FF and added it to my program, but it really bugs me that I have no real knowledge what is going on.

Thanks, please don't flame me too much!

• Do you have any references we can look at. I have no idea how/where firefox uses 3DES. – mikeazo Oct 1 '14 at 15:42
• We don't flame. We downvote. – rath Oct 2 '14 at 22:40

To get that key material from a password, a Password Based Key Derivation Function (PBKDF) is usually used. The details differ depending on the algorithm, but the key idea is to take the password and run it (one or more times) through a cryptographically secure hash function, which has a fixed size output. The output is usually longer than what you need, so you just take the first $k$ bits to make a key of size $k$.