Counterpane Password Safe Insecure Encryption Vulnerability

Counterpane Password Safe Insecure Encryption Vulnerability

Counterpane Password Safe is susceptible to an insecure encryption vulnerability that allows easier brute force decryption attacks.

Password Safe uses a key-stretching algorithm designed to dramatically slow down brute force password guessing attacks. A random value is encrypted with the Blowfish algorithm one thousand times with a value derived from the password used as the encryption key. In order to brute force attack the Password Safe database, an attacker must follow the same one thousand encryption steps on every password guess. This is done to make brute force attacks much more time and resource intensive, lowering the likelihood of a successful attack.

This vulnerability allows attackers with access to the Password Safe database to employ a brute force password guessing attack against the database much more efficiently that the Password Safe design intended. The data contained in the Password Safe database aids malicious users in further attacks.