Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 9 Jan 2013 12:07:03 +0530
From: Dhiru Kholia <>
Subject: Re: 1Password 4 Cloud Keychain format for your cracking pleasure

On Wed, Jan 9, 2013 at 2:04 AM, Jeffrey Goldberg <> wrote:
> We (I work for AgileBits, the makers of 1Password) are rolling out our new Cloud Keychain Format, which will replace the Agile Keychain format that you already have tools for.
> The link above describes the major changes. What you will be after is in the profile.js file (our format continues to use multiple files). I can post a sample profile.js file (with known Master Password) for testing if you'd like.

This really shows the confidence you guys have in your security design!

I really like the resilience of 1Password against data corruption
which is missing in other passwords managers.

> The major differences as far as crackers are concerned is that we now use PBKDF2-SHA512 to derive a 256-bit AES key and a 256-bit HMAC-SHA256 key (instead of PBKDF2-SHA1 and no MAC). Presumably, you will find the HMAC key faster to verify than performing AES decrypts.

Thanks for the heads up. A sample profile.js file (with known Master
Password) would be really useful. Also, are there any plans to update utility?


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.