how-to-password-protect-best-security-10

What other than 'password' do you have as a lock - key function in the World Wild Web? How KeePass is useful for you and me?


Key Protection against Dictionary Attacks
FACT
You
can't really prevent dictionary and guessing attacks: nothing prevents
an attacker to just try all possible keys and look if the database
decrypts. But what we can do (and KeePass does) is to make it harder:
by adding a constant time factor to the key initialization, with KeePass we can make them as hard as we want.

To generate the final 256-bit key that
is used for the block cipher, KeePass first hashes the user's password
using SHA-256, encrypts the result N times using the Advanced
Encryption Standard (AES) algorithm (called key transformation rounds
from on now), and then hashes it again using SHA-256. For AES, a random
256-bit key is used, which is stored in the database file. As the AES
transformations aren't pre-computable (key is random), an attacker has
to perform all the encryptions, too, otherwise he cannot try and see if
the current key is correct.

An attacker now needs much more time
to try a key. If he can only try a few hundred keys per second, a
dictionary attack is not practical any more.

By default, KeePass
sets N to 6000 encryption rounds (full encryptions are meant; N has
nothing to do with the internal encryption rounds of AES). This has
been done in order to provide compatibility with the PocketPC version
(PocketPC processors are slower, therefore the key computation takes
longer).


What KeePass does?
KeePass supports protection against guessing and dictionary attacks.

Protect your Password.
If you are using KeePass on PC only, it is highly
recommended to increase the number of key transformation rounds. You
can change the number in the database options dialog. Right of the
field for the rounds, you'll find a button. When clicking this button,
KeePass computes the rounds number that leads to a 1-second delay.
Waiting 1 second at database opening isn't a problem, but for an
attacker of course it is. But, the number can be freely set to a number
of your choice. The button only should give you a rough idea how many
rounds can be computed in 1 second on your computer.

This
protection feature is only useful when using master passwords; key
files are random anyway, there's no need to transform the key file
contents (guessing the key file contents is equally hard to a
brute-force attack on the final key).

KeePass uses
multi-threading to compute these rounds (the master key is split up to
two parts of 128 bits, which is the AES block size). On dual/multi core
processors, the computation can be twice as fast as on a single core
processor. Note the 1-second button in the database settings dialog
always shows the single core rounds number (the dual/multi core
optimization only affects the "real" transformation code, not the
benchmark).

Detailed information about the security of KeePass.


* Database Encryption
* Hashing and Key Derivation
* Random Number Generation
* Protection against Dictionary Attacks
* Process Memory Protection
* Locking the Workspace
* Plugins
* Self-Tests
* References

Key Database Encryption


KeePass database files are encrypted. KeePass encrypts the whole database, i.e. not only your passwords. Your user names, notes, even the entry times and UUIDs, etc. are encrypted, too.


The databases are encrypted using one of the following block ciphers:
Cipher Block Size Key Size
Advanced Encryption Standard (AES / Rijndael) 128 bits 256 bits
Twofish 128 bits 256 bits


These algorithms are well-known, analyzed thoroughly and generally considered to be very secure by the cryptographic community.
KeePass 2.x Only
KeePass 2.x doesn't support Twofish, but additional encryption algorithms are available through plugins.

The block ciphers are used in the CBC (cipher-block chaining) block cipher mode. In CBC mode, plaintext patterns are concealed.


For both algorithms, a 128-bit initialization vector (IV) is generated randomly each time you save the database. This allows multiple databases to be saved using the same key without observable patterns being revealed.

Key Hashing and Key Derivation
In order to generate the 256-bit key for the block ciphers, the Secure Hash Algorithm SHA-256 is used. This algorithm compresses the user key provided by the user (consisting of password and/or key file) to a fixed-size key of 256 bits. This transformation is one-way, i.e. it is computationally infeasible to invert the hash or find a second message that compresses to the same hash.


Please note that the recently discovered attack against SHA-1  doesn't affect the security of SHA-256. SHA-256 is still considered as being secure.


Key Derivation:
If only a password is used (i.e. no key file), the password plus a 128-bit random salt are hashed using SHA-256 to form the final key (but note there is some preprocessing: Protection against Dictionary Attacks). This random salt prevents attacks that are based on pre-computed hashes.

When using both password and key file, the final key is derived as follows: SHA-256(SHA-256(password), key file contents), i.e. the hash of the master password is concatenated with the key file bytes and the resulting byte string is hashed with SHA-256 again. If the key file doesn't contain exactly 32 bytes (256 bits), they are hashed with SHA-256, too, to form a 256-bit key. The formula above then changes to: SHA-256(SHA-256(password), SHA-256(key file contents)).

Binary Random Number Generation

We need to generate several random bytes (for the IV, the master key salt, etc.). For this, several pseudo-random sources are used: current tick count, performance counter, system date/time, mouse cursor position, memory status (free virtual memory, etc.), active window, clipboard owner, various process and thread IDs, various window focus handles (active window, desktop, ...), window message stack, process heap status, process startup information and several system information structures. Additionally, KeePass uses random bytes provided by the system's default CSP RNG.

This pseudo-random data is collected in a random pool. To generate 16 random bytes, the pool is hashed (SHA-256) with a counter to form the final 16 random bytes. The counter is increased after 16 generated bytes. This way, we can efficiently produce as many secure random bytes as we need.

KeePass supports protection against guessing and dictionary attacks.
Source:
Security - KeePass

On Fast Track
with
Dr. Ashok Koparday

Read more On "how-to-password-protect-best-security-10"!

best-secure-password-generator-9

Passwords Protection

While KeePass[1] is running, your passwords are stored encrypted [2] in process memory. For this, the ARC4 encryption algorithm is used, using a random, 12 bytes long key.


This means that even if you would dump the whole KeePass process memory to disk, you couldn't find the passwords (at least not in plain text). Note that this only applies to the password [3]field, not to the user names, etc. because of performance reasons.


When you are copying a password to the clipboard for example, KeePass first decrypts the password field, copies it to the clipboard and immediately re-encrypts it using the random key.


Additionally, KeePass erases all security-critical memory when it's not needed any more, i.e. it overwrites these memory areas before releasing them (this applies to all security-critical memory, not only the passwords field).


Key Locking the Workspace


Locking the workspace closes the database file, and remembers the last view settings (i.e. which group and entries you selected, list position, etc.).


This provides maximum security: unlocking the workspace is as hard as opening the database file the normal way. Also, it prevents data-loss (your computer can crash while KeePass is locked, without doing any damage to the database).

Plugins Security


Separate pages exist about the security of plugins: Plugin Security (KeePass 1.x), Plugin Security (KeePass 2.x).

Black Box[4] Self-Tests


Each time you start KeePass, the program will perform a quick self-test to see whether the block ciphers[5] and the hash are compiled correctly and pass their test-vectors. If one of the algorithms doesn't pass its test vectors, KeePass will show a security exception message box at startup.

References References and Further Reading
Security - KeePass

(1) National Institute of Standards and Technology: Report on the Development of the Advanced Encryption Standard (AES) (PDF).


(2) Bruce Schneier's blog: SHA-1 broken.


[3] Bruce Schneier's blog: Cryptanalysis of SHA-1, with comments about the impact of that discovery and what to do now.

On Fast Track
with
Dr. Ashok Koparday
[1]
[2]encrypted
password
[4]
[5]block ciphers

Read more On "best-secure-password-generator-9"!

how-to-use-privacy-guard-8

Email programs - Use Encrypt Decrypt
For Safe, Secure On line Experience

Out of the box security solution.
Gnu Privacy Guard (GnuPG)
Mini Howto (English)

Brenno J.S.A.A.F. de Winter (English)
brenno@dewinter.com
Michael Fischer v. Mollard (German)
fischer@math.uni-goettingen.de
Arjen Baart
arjen@andromeda.nl
Version 0.1.4 August 10, 2004

This documents explains how to use the GNU Privacy Guard (GnuPG), an Open Source OpenPGP compatible encryption system

To keep this program totally free the use of the RSA algorithm and other patented algorithm has been avoided. The document was originally written by Michael Fischer v. Mollar in German. The text has been translated and adjusted on some points and cannot be considered as a full one-on-one copy.

1. Concepts

* 1.1 Public Key Encryption
* 1.2 Digital Signatures
* 1.3 Web of trust
* 1.4 Boundaries to security

2. Installation

* 2.1 Sources for GnuPG.
* 2.2 Configuration
* 2.3 Compile
* 2.4 Installation

3. Using keys

* 3.1 Creating a key
* 3.2 Exporting keys
* 3.3 Importing keys
* 3.4 Revoke a key
* 3.5 Key administration
* 3.6 Key signing

4. Encrypt and decrypt

* 4.1 Encrypt
* 4.2 Decrypt

5. Signing and checking signatures

6. Front ends

* 6.1 Graphical interfaces
* 6.2 Email programs

7. Sources of information

* 7.1 GnuPG
* 7.2 PGP
* 7.3 Keyservers
* 7.4 Books

8. About this document

* 8.1 Versions
Gnu Privacy Guard (GnuPG) Mini Howto (English)
On Fast Track
with
Dr. Ashok Koparday

Read more On "how-to-use-privacy-guard-8"!

how-to-make-email-trustworthy-encryption-6

How to be certain that email has come from a particular person?


keywords: muttmail reader,
public key cryptography[1]

In your Gmail inbox, click on, 'Show Details'. This is what you see.

from DR. ASHOK KOPARDAY Medical Director Samadhan Sexual Sciences
to anita_usa@gmail.com
date Sun, Jan 11, 2009 at 10:36 PM
subject [help on mobile] convert-indian-language-to-any-other-indian-language-using-b...
mailed-by blogger.bounces.google.com

VIII. Understanding The Need For Message Signatures The first reason for message signatures is authenticity. It is a largely unknown fact that the From: header of email can be trivially forged. A quick glance can lead you to believe that the mail was sent by someone who might not have had anything to do with the message. A signature will help you determine if the mail was really sent by who you think it was sent by. The second reason for signatures is integrity. Someone who has access to any piece of mail that is waiting for you (perhaps at your ISP) can change the message. This could affect something as simple as where you should meet someone to something as serious as which bank account you should transfer money to. A signature can tell you if the message was modified between the sender and your mail client.

This document
will explain the need for signing and how to sign messages, how to
verify signatures on mail sent to you, how to encrypt messages, and how
to decrypt messages. 
Theft of your private key by anyone means theft of your identity.  In anincreasingly digital world, your private key will soon carry as muchweight as a photo ID, and in some situations already carries more.  

========================================================================

      Everything You Need To Know To Start Using GnuPG with Mutt

========================================================================

             By Justin R. Miller 

              Revision 0.1, Released 23 September 2001

========================================================================

     I. Purpose
    II. Overview
   III. Assumptions
    IV. Configuring GnuPG
     V. Protecting Your Private Key
    VI. Publicizing Your Public Key
   VII. Understanding Validity and Your Web of Trust
  VIII. Understanding The Need For Message Signatures
    IX. Understanding How Signatures Are Made
     X. Understanding How Encryption Is Done
    XI. A Practical Example of Manual Key Management
   XII. A Practical Example of Manual Signing and Verification
  XIII. A Practical Example of Manual Encryption and Decryption
   XIV. Configuring Mutt For Use With GnuPG
    XV. Trying It All Out
   XVI. Links For More Information
  XVII. Contributors
 XVIII. Feedback

On Fast Track
with
Dr. Ashok Koparday

Read more On "how-to-make-email-trustworthy-encryption-6"!