3
$\begingroup$

For a personal project, I'm building a password manager, based off the project in this syllabus from Stanford http://crypto.stanford.edu/~dabo/cs255/hw_and_proj/proj1.pdf

Since I don't exactly have to take the class for the credit and strictly follow the instructions, I've gone ahead and changed some things (like I added a MySQL DB for the backend). What I'm wondering is this: how do you handle someone changing the master password? I have a master password that is used just like the syllabus says, but what if I want to flesh it out more, and have an option to change your master password (seems like something a password manager should have!). How do I implement this? The straightforward way is to simply decrypt everything then re encrypt everything with the new master password. I was just wondering if there's something that's not so inelegant that I'm missing.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
3
$\begingroup$

In the context of most Password Managers that use encryption, you will generate a Master Data Encryption Key (MDEK) which will serve to encrypt all the passwords and the user's password would be the Key Encrypting Key (KEK) to encrypt the MDEK. This way, the MDEK stays the same when you change your Master Password derived KEK that wraps the MDEK.

Improve this answer
$\endgroup$
4
  • 1
    $\begingroup$ The Key Encrypting Key should instead be securely derived from the user's master password. ​ ​ $\endgroup$
    – user991
    Commented Jan 24, 2016 at 3:29
  • $\begingroup$ "password derived KEK that wraps the MDEK" which actually meant master password derived but I guess I did not make it very clear. Made a change to the reply to make it clearer. $\endgroup$
    – thotheolh
    Commented Jan 24, 2016 at 4:36
  • 3
    $\begingroup$ In particular, "the user's password would" usually not "be the Key Encrypting Key". ​ ​ $\endgroup$
    – user991
    Commented Jan 24, 2016 at 6:31
  • 2
    $\begingroup$ Yeah, that should read "derived from the user's master password" or something similar. $\endgroup$
    – Maarten Bodewes ♦
    Commented Jan 24, 2016 at 13:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.