[NT] PasswordSafe Weak Random Number Generator Allows Key Recovery Attack

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



PasswordSafe Weak Random Number Generator Allows Key Recovery Attack
------------------------------------------------------------------------


SUMMARY

PasswordSafe is a program originally written by security expert Bruce
Schneier (http://www.schneier.com) that allows one to store users'
passwords in single file (called "safe") which is encrypted and protected
by user's master password (called "Safe Combination") with the Blowfish
encryption algorithm. As noted on PasswordSafe web page, "the program's
security has been thoroughly verified by Counterpane Labs under the
supervision of Bruce Schneier, author of Applied Cryptography and creator
of the Blowfish algorithm."

As noted in "Password Safe FAQ", "there is no back door in PasswordSafe to
recover your Safe Combination, but there is a password-guessing program
that some people have used successfully. The program works by going
through a list of possible passwords and checking each one".

Version 3.0 introduces new password database format which (theoretically)
eliminates security flaw found by ElcomSoft Co. Ltd. in November 2005, and
does not allow an attacker to bypass key stretching algorithm any more.

However, there is even more serious security flaw in PasswordSafe version
3.0, which allows to recover 256-bit database encryption key in a
reasonable time (under certain conditions). And with the recovered
encryption key, it is to decrypt all database records (logins, passwords,
etc) without the master password (so-called "Safe Combination").

DETAILS

Vulnerable Systems:
* PasswordSafe version 3.0Beta

NOTE:
PasswordSafe is still a BETA release! It should NOT be used as the only
tool for storing "real" password information. For securely storing real
password entries, please use release 2.16.

Technical Details:
PasswordSafe 3.0 utilizes two different random number generator (RNG)
functions: Win32 API RtlGenRandom() and standard Visual C++ rand().
RtlGenRandom() is not available on Windows prior to Windows XP (i.e.
Windows 2000, Windows NT, Windows Me) so rand() is used instead.
Specifically, rand() is used to generate 256-bit database encryption key.
It is widely known that using rand() in cryptographic applications is not
secure due to its predictability and small internal state.

It is possible to mount guaranteed decryption attack on PasswordSafe 3.0
databases created under OS prior to Windows XP. The attack is very simple:

1. Generate 256-bit key for every possible seed value
2. Decrypt first database record (the structure is documented, so we have
known plaintext attack)
3. Check decrypted value against the known plaintext

The total number of all possible seed values is limited by 2^32, so it is
quite feasible. Our experiments show that the key can be
recovered in less than 6 hours on the single PC (Pentium 4).

Impact:
PasswordSafe is used to store sensitive data, and so the presence of such
flaws may help attacker to disclose user's logins, passwords and PINs by
implementing efficient key recovery attacks.

Solution/workaround:
PasswordSafe should not use rand() function; cryptographic RNG should be
used instead.


ADDITIONAL INFORMATION

The information has been provided by <mailto:info@xxxxxxxxxxxxx>
ElcomSoft Co.Ltd.



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages