JtR's "dashlane" format (2017) needs updating to reflect Dashlane's revised hashing procedure
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 13.6k
- Forks
- 2.6k
- PR merge metrics
- No merged PRs in 30d
Description
🥇👍
Original JTR Dashlane format created here: Add support for Dashlane password manager #2658
The JtR "--format=dashlane" no longer accurately reflects Dashlane's current hashing procedure as described in this revised Dashlane Security Whitepaper-March 2021. Consequently JtR's --format=dashlane can no longer successfully be used to match Dashlane's revised hash format.
When the format was developed in 2017, Dashlane used OpenSSL’s PKCS5 PBKDF2 HMAC1 function with 10204
iterations with the indicated salt to produce a derived key, yielding a SHA-1 format hash.
Now according to the whitepaper, Dashlane has switched from PBKDF2 to Argon2d:
"The User Master Password is used, with the salt, to generate the AES 256-bit
key that will be used for (en|de)cryption. We use Argon2d, by default, with the
following parameters: iterations = 3, memory = 32Mo, parallelization = 2. We also
support PBKDF2-SHA2 with 200,000 iterations."
I'm hoping to get some help revising this JtR format to support Dashlane's current hashing procedure.
Attach details about your OS and about john, including:
- Output of
./john --list=build-info: Version: 1.9.0-jumbo-1 Build: cygwin 64-bit x86_64 AVX2 AC OMP - Command line you are using: JtR/run>john --wordlist=mydata/wordlist.txt --format=dashlane mydata\mydashlane.hash
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the --format=dashlane entry point and compare its current behavior with the revised Dashlane Security Whitepaper linked in the issue. Investigate how the existing format handles the legacy PBKDF2 procedure and determine the expected revised-hash behavior; done means the format can match hashes produced by Dashlane's current procedure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100