3
$\begingroup$

Keepass is a well known open-source password manager program, with plugin support. One of the offered plugin is a twofish encryption mode of operation in lieu of the build-in AES algorithm (http://keepass.info/plugins.html#twofishcipher).
Since I am fond of the xfish cipher family, I looked at the source of that plugin before using it.
That plugin ( http://gogogadgetscott.info/keepass/twofishcipher/) uses the C# twofish implementation from http://www.codeproject.com/Articles/2593/A-C-implementation-of-the-Twofish-cipher in CBC mode.

In the C# source (file Twofish.cs) , the developer uses a all-zeros Initialization Vector (I am not sure how to relate to the Key zeroing): 

    /// <summary>
    /// Generates a random initialization Vector (IV). 
    /// </summary>
    public override void GenerateIV()
    {
        IV = new byte[16]{0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
    }

    /// <summary>
    /// Generates a random Key. This is only really useful in testing scenarios.
    /// </summary>
    public override void GenerateKey()
    {
        Key = new byte[KeySize/8];

        // set the array to all 0 - implement a random key generation 
                    // mechanism later probably based on PRNG
        for (int i=Key.GetLowerBound(0);i<Key.GetUpperBound(0);i++)
        {
            Key[i]=0;
        }
    }

Since Keepass is used to encrypt a dynamic set of password records with the same master password, I would assume that this implementation has some major security issues. I would like to solicit comments from the community on the above before I bring my concern up with the developer.

Note: In SUSE Linux 9.2 and below, they also used IV=[0] for their twofish CBC module: "With SUSE LINUX 9.3 we switched from loop_fish2 to twofish as the encryption module. twofish together with cryptoloop is now the standard method for crypto partitions. We made that switch because twofish together with cryptoloop is more secure (cryptoloop uses the block number as the initialization vector, whereas loop_fish2 always uses zero) and is the standard solution for crypto partitions."

Improve this question
$\endgroup$
2
  • 1
    $\begingroup$ Looking at the code again, I think this actually isn't a problem. I am not familiar with how Keepass handles plugins but I would expect it to pass its own generated key/IV's to the underlying plugin rather than let it generate them itself (see the EncryptStream() method, public and hence exported from the plugin, taking pbKey and pbIV as arguments). In that case the dummy implementations above exist only to satisfy the contract of the C# SymmetricAlgorithm interface. Though it would be better to properly implement them to be able to reuse the Twofish implementation elsewhere.... $\endgroup$
    – Thomas
    Aug 23, 2013 at 14:28
  • $\begingroup$ @Thomas - Thank you. I will investigate the code further. $\endgroup$
    – Ninveh
    Aug 23, 2013 at 17:53

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.