A Password Manager.

Today I was in a hurry to book a train ticket to Chennai. The booking site took me to the payment gateway. Wait a minute.. you gotta type in your transaction password dude but wot is the password? …:o :o 1, 2, 3 there you go , my card has been blocked. It was really a pain. How many username – password combination I could remember? Certainly I need some assistance. As a result, a little project for this weekend. How about developing a Password Manager (PM)? But there are a dozen of such things already existing in the net. Why do you need to write one ? Well.. answer to this question is pretty simple. I don’t wanna use any third party software and above all Coding is Fun.

What are my requirements?
1. I need all my usernames and passwords to be stored with high security.
2. I also need a single invisible key to the whole treasure box so that others have absolutely no idea about the bits and pieces of my Master Key (MK).

That’s fine. Wot about the box?
3. It should be rock-hard to break open.

Having these things in my mind, I went for a design.

I used password based encryption, so that my MK will reside in my brain satisfying the requirement 2. I went for AES 128 with SHA 512 hashing for which till date there are no practical cryptanalysis attacks. Hence the treasure box is tamper proof. Treasure box is a layman term, let’s say the “pass.stor” file. Having done this I can be sure that I am safe. Let’s get into the technical part of it.

A 128 bit key is generated using (MK, salt, iteration) the triplet is given as input to the key derivation function. Salt is a random number and ‘iteration’ refers to the number of iterations of the function. Then I apply AES over this key to generate the AES 128 bit key.

Now for encryption, a completely random 16 bits of initialization vector (IV) is generated. For generating random bits I use SHA1PRNG which is pretty decent. For people who don’t know about IV, it is basically introduced in encryption process to produce different cipher text every time you encrypt with the same key. To be precise it is a source of randomness. Finally I encrypt the usernames and passwords using the generated AES key and the IV. The encrypted contents get into the ‘pass.stor’.

Decryption is just the reverse of above process. Except that we need to take care of the IV part of the encrypted content separately. That’s all about the cryptographic part of implementation.

Now what are the features can be added to the utility?

1. I need to add a username-password for a website using the MK.
2. I may also want to update the existing contents.
3. I should retrieve the contents using the MK.

Since the MK is not stored anywhere we may not be able to authenticate the user. This is not a problem when you add an entry, since addition doesn’t expose any data. I simply use the MK provided by the user to add entries. Retrieving is pretty straight forward, for the given website use the MK and perform decryption.

But how can we perform updation? Only authorized users should update the contents. I don’t have a direct solution. One possible way could be digesting the MK using SHA or MD5 but that will result in storing the digested form of MK.

Remember the salt we used during key generation? I used the message digest of the MK as salt. Hence during update providing a wrong MK would result in a wrong message digest and hence a wrong derived key so the decryption will fail. I used this as a little hack and authenticate the user by testing his MK against the cipher. :) Does this sound a little dumb? :-p

Finally a great relief ! I am using it to store all my username-password pairs and I am happy that my card will not get blocked in future..!! :)

Here is the utility .Try it out and comments are welcome. Bugs are most welcome.
Happy Password Keeping !!!

Cheers,
Surya