openwall / openwall/john

JtR's "dashlane" format (2017) needs updating to reflect Dashlane's revised hashing procedure

Open
#4,827 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
C
Stars
13.6k
Forks
2.6k
PR merge metrics
No merged PRs in 30d

Description

🥇👍

Original JTR Dashlane format created here: Add support for Dashlane password manager #2658

The JtR "--format=dashlane" no longer accurately reflects Dashlane's current hashing procedure as described in this revised Dashlane Security Whitepaper-March 2021. Consequently JtR's --format=dashlane can no longer successfully be used to match Dashlane's revised hash format.

When the format was developed in 2017, Dashlane used OpenSSL’s PKCS5 PBKDF2 HMAC1 function with 10204
iterations with the indicated salt to produce a derived key, yielding a SHA-1 format hash.

Now according to the whitepaper, Dashlane has switched from PBKDF2 to Argon2d:

"The User Master Password is used, with the salt, to generate the AES 256-bit
key that will be used for (en|de)cryption. We use Argon2d, by default, with the
following parameters: iterations = 3, memory = 32Mo, parallelization = 2. We also
support PBKDF2-SHA2 with 200,000 iterations."

I'm hoping to get some help revising this JtR format to support Dashlane's current hashing procedure.

Attach details about your OS and about john, including:

  • Output of ./john --list=build-info: Version: 1.9.0-jumbo-1 Build: cygwin 64-bit x86_64 AVX2 AC OMP
  • Command line you are using: JtR/run>john --wordlist=mydata/wordlist.txt --format=dashlane mydata\mydashlane.hash

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the --format=dashlane entry point and compare its current behavior with the revised Dashlane Security Whitepaper linked in the issue. Investigate how the existing format handles the legacy PBKDF2 procedure and determine the expected revised-hash behavior; done means the format can match hashes produced by Dashlane's current procedure.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
cryptography, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.