Re: Validation flaw addressed in version 2.14

On 11/23/05, Rony Shapiro <[email protected]> wrote:

> I'd like to ask this list for suggestions for (1) a better solution that
> would keep compatability with previous versions (that is, that previous
> versions 2.x of PasswordSafe will be able to read the new database, and (2)
> a complete solution, unencumbered by backwards-compatability (that is, a new
> version of the database format).

I'm afraid I have suggestions for neither; however, wrt. (2) I wonder
if any new proposed solution should be opened up far wider for review
in the appropriate communities. Hopefully, that should  mean that any
new database format won't hit the current problem.

That said, a new database format would be the ideal time to move away
from SHA1 which, although still secure, is perhaps best not used for
new applications.

It also raises the opportunity to think about putting in structure
that encrypts each record individually. That, coupled with a
timestamp, would allow records to be sync'ed to a PDA without
prompting the user for the Safe combination. That said, I recognise
that this may decrease the effort required to brute force the Safe as
there are now have a number of different locks each with the same
combination. Maybe with something like AES with a big enough key that
is no longer an issue - I don't know, but then I'm not an expert in
that arena.

This would leave a DB structure along the lines of
[Record 1 length][Timestamp 1][Stuff for encryption][Name 1]¦[Password
1]|[Notes 1]
[Record 2 length][Timestamp 2][Stuff for encryption][Name 2]¦[Password
2]|[Notes 2]
...
which would mean that [Record n length] and [Timestamp n] were
unencrypted - but the rest of the fields in the record could be copied
independently when syncing databases without a password.

That said, I wouldn't like to hazard a guess as to what would go in
[Stuff for encyption] !

My 2p,

Greg


-------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Do you grep through log files
for problems?  Stop!  Download the new AJAX search engine that makes
searching your log files as easy as surfing the  web.  DOWNLOAD SPLUNK!
http://ads.osdn.com/?ad_idv37&alloc_id865&op=click