Commits on Mar 9, 2024

1. Prevent byte-by-byte and attachment inference side channel attacks …

   Attack - KeeShare attachments can be inferred because of attachment de-duplication.
   
   Solution - Prevent de-duplication of normal database entry attachments with those entry attachments synchronized/associated with a KeeShare database. This is done using the KeeShare database UUID injected into the hash calculation of the attachment prior to de-dupe. The attachments themselves are not modified in any way.
   
   --------
   
   Attack - Side channel byte-by-byte inference due to compression de-duplication of data between a KeeShare database and it's parent.
   
   Solution - Generate a random array between 64 and 512 bytes, convert to hex, and store in the database custom data.
   
   --------
   
   Attack vector assumptions:
   1. Compression is enabled
   2. The attacker has access to a KeeShare database actively syncing with the victim's database
   3. The victim's database is unlocked and syncing
   4. The attacker can see the exact size of the victim's database after saving, and syncing, the KeeShare database
   
   Thank you to Andrés Fábrega from Cornell University for theorizing and informing us of this attack vector.

   

   droidmonkey committed Mar 9, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for dccf0e0
   • Browse repository at this point

   Copy the full SHA

   dccf0e0 View commit details

   Browse the repository at this point in the history