[Ex094]

@Ex094 a master password is a pass(word|phrase) used to decrypt encrypted content. It serves as a key when encrypting the data. To decrypt the content you need to provide this key which is why it must never be stored anywhere.

At least this is my understanding of it, so feel free to correct me if I'm wrong

Thanks for the helpful explanation, I knew about Master Password but I was confused that how it would be used to encrypt/decrypt.

[RogueCoder]

You're welcome @Ex094 Glad I could help out

[Deque]

@Deque Yes you are pretty much correct, I got myself confused between and Encryption and Encoding. Well that makes sense as the passwords are not secure at all. Can you explain what you suggested a little bit more (The master password part)

Let's take as example how Firefox stores login data.
It saves these logins encrypted with 3DES. But it needs a key for doing so. A hardcoded key is not secure at all, but is the only solution if the user doesn't give a masterpassword.
If the user sets a masterpassword, this password is used to generate the key for 3DES encryption and decryption.
You don't have to save the password. The program recognizes that you have given the correct password by a known passphrase in the file.

I.e. imagine you have a passwordfile as txt that looks like this:

Code:

mysimplepassphrase user:pass user:pass user:pass ...

Now you encrypt the whole file, including the passphrase.
Some time later when the user wants access to the passwords, he has to give you the masterpassword, that you used for encryption.
You also use the given password for decryption. If it was the right one, the passphase mysimplepassphase is readable again. You do something like (Pseudocode):

Code:

decryptedtext = decrypt(file) firstline = decryptedtext.readLine() if(firstline == "mysimplepassphrase") { correctpass } else { wrongpass }

[RogueCoder]

@Deque Yes you are pretty much correct, I got myself confused between and Encryption and Encoding. Well that makes sense as the passwords are not secure at all. Can you explain what you suggested a little bit more (The master password part)

Let's take as example how Firefox stores login data.
It saves these logins encrypted with 3DES. But it needs a key for doing so. A hardcoded key is not secure at all, but is the only solution if the user doesn't give a masterpassword.
If the user sets a masterpassword, this password is used to generate the key for 3DES encryption and decryption.
You don't have to save the password. The program recognizes that you have given the correct password by a known passphrase in the file.

I.e. imagine you have a passwordfile as txt that looks like this:

Code:

mysimplepassphrase user:pass user:pass user:pass ...

Now you encrypt the whole file, including the passphrase.
Some time later when the user wants access to the passwords, he has to give you the masterpassword, that you used for encryption.
You also use the given password for decryption. If it was the right one, the passphase mysimplepassphase is readable again. You do something like (Pseudocode):

Code:

decryptedtext = decrypt(file) firstline = decryptedtext.readLine() if(firstline == "mysimplepassphrase") { correctpass } else { wrongpass }

Very well explained! Thank you

[Ex094]

@Deque Thanks for the explanation, I'll look into implementing a similar system for my Pass Manager

[ArkPhaze]

@Deque Yes you are pretty much correct, I got myself confused between and Encryption and Encoding. Well that makes sense as the passwords are not secure at all. Can you explain what you suggested a little bit more (The master password part)

Let's take as example how Firefox stores login data.
It saves these logins encrypted with 3DES. But it needs a key for doing so. A hardcoded key is not secure at all, but is the only solution if the user doesn't give a masterpassword.
If the user sets a masterpassword, this password is used to generate the key for 3DES encryption and decryption.
You don't have to save the password. The program recognizes that you have given the correct password by a known passphrase in the file.

I.e. imagine you have a passwordfile as txt that looks like this:

Code:

mysimplepassphrase user:pass user:pass user:pass ...

Now you encrypt the whole file, including the passphrase.
Some time later when the user wants access to the passwords, he has to give you the masterpassword, that you used for encryption.
You also use the given password for decryption. If it was the right one, the passphase mysimplepassphase is readable again. You do something like (Pseudocode):

Code:

decryptedtext = decrypt(file) firstline = decryptedtext.readLine() if(firstline == "mysimplepassphrase") { correctpass } else { wrongpass }

If I'm understanding this correctly, "mysimplepassphrase" is used for both the encryption and decryption as the key, but for decryption, it checks against the hardcoded plaintext of the master password anyways to see if you have entered the master password as input, itself? :lol:

I would save that checking value as an SHA256 hash or something, then on decryption, check if $sha256_hash(value) is == the hardcoded value if you're going to hardcode anything.

Even better to include some kind of salt on top to add a bit of "zest". (Bake for 20 minutes, and then let stand for 5. lol)

[Deque]

If I'm understanding this correctly, "mysimplepassphrase" is used for both the encryption and decryption as the key, but for decryption, it checks against the hardcoded plaintext of the master password anyways to see if you have entered the master password as input, itself? :lol:

I would save that checking value as an SHA256 hash or something, then on decryption, check if $sha256_hash(value) is == the hardcoded value if you're going to hardcode anything.

Even better to include some kind of salt on top to add a bit of "zest". (Bake for 20 minutes, and then let stand for 5. lol)

No. The master password is never stored. "mysimplepassphrase" is not used as a key. It is a known plaintext. Not more or less. Let's rename it to "knownplaintext". The only purpose of "knownplaintext" is to know whether the decryption was successful.

Storing a hash like you want to do it, is more insecure and not necessary.

I shall change the pseudocode for more clarity:

This is encrypting:

Code:

masterpass = getUserInput("What is your master password?") text = "knownplaintext\n" + logindata encryptedText = text.encrypt(masterpass) writeToFile(encryptedText)

This is decrypting:

Code:

masterpass = getUserInput("What is your master password?") decryptedtext = file.decrypt(masterpass) firstline = decryptedtext.readLine() if(firstline == "knownplaintext") { #correct pass was used, because we could successfully decrypt the known plaintext } else { #wrong pass, the text was decrypted to some glibberish }

Also: SHA is not the best hash algorithm for passwords. There are better ones, which where solely designed for storing password hashes. Example: scrypt (>>link<<)

[Ex094]

@Deque Is it possible if I use the master password as a salt to encrypt the details?

[Deque]

@Deque Is it possible if I use the master password as a salt to encrypt the details?

Why would you want to do that?
1. Why a salt? You are not hashing, you are encrypting.
2. Why use the key as the salt? That doesn't make sense.

[Ex094]

@Deque Is it possible if I use the master password as a salt to encrypt the details?

Why would you want to do that?
1. Why a salt? You are not hashing, you are encrypting.
2. Why use the key as the salt? That doesn't make sense.

Ah yes! I must be outta my senses, Sorry for that. The question just came into my mind. Understood now

The pseudo code you gave above, I am confused with this line:

Code:

text = "knownplaintext\n" + logindata