Re: [gnukeyring-discuss] development

[Jochen H. <Hoe...@In...>]

On Friday 24 October 2003 03:46, Martin Pool wrote:
> On 23 Oct 2003, Florin Andrei <fl...@sg...> wrote:
> > (*) - Much more important seems to be the master password on the Keyring
> > application. If that's too weak, the database is easily crackable.
>=20
> I think this is the limiting factor.  I think most people would not
> have the patience to write a passphrase of more than about 5-8
> characters.
>=20
> Since an astute attacker can try to decode it on a PC, they can cycle
> through combinations much faster than somebody could write them.

Yes, this is the biggest problem. I have added a figure at
http://gnukeyring.sf.net/crypto.html to demonstrate the importance of
a good password.

> Of course there might also be bugs.  This was the first real crypto
> program I wrote (quite a few years ago now), though other people and
> especially Jochen have checked it later.

There was a bug in 1.0 (cached encryption key was never removed), so
anyone who is still using that version should upgrade immediately.
There was even an exploit for this bug.

I don't know of any other serious bugs in the crypto algorithms, but a
few weaknesses are described on the page mentioned above, e.g. one can
see from the encrypted database which records have the same password
or account.  Also the database is not tamper-proof, but that isn't
really important as an attacker with write access to the palm would
most likely tamper the keyring binary not the database.

  Jochen

=2D-=20
Jochen Hoenicke, University of Oldenburg, 26111 Oldenburg, Germany
Email: hoe...@in...  Tel: +49 441 798 3124