KWallet explained

KDE Wallet Manager
KDE Frameworks 5
Logo Size:	70px
Screenshot Size:	250px
Developer:	KDE
Programming Language:	Mainly C++ (Qt), some C
Operating System:	Cross-platform
License:	Various LGPL

KDE Wallet Manager (KWallet) is free and open-source password management software written in C++ for UNIX-style operating systems. KDE Wallet Manager runs on a Linux-based OS and Its main feature is storing encrypted passwords in KDE Wallets.^[1] The main feature of KDE wallet manager (KWallet) is to collect user's credentials such as passwords or IDs and encrypt them through Blowfish symmetric block cipher algorithm or GNU Privacy Guard encryption.

Installation

KDE Wallet Manager (KWallet) requires a Linux-based OS and the KDE Software Compilation desktop environment such as Kubuntu.^[2]

Browser extensions

KDE Wallet manager (KWallet) can be integrated with various web browsers including Chrome, Opera, and Edge.

To use KDE Wallet manager (KWallet) integration on Google Chrome or any other Chromium based browsers, user needs to run the browser with argument --password-store=kwallet5 or --password-store=detect .^[3]

Historically, there was a standalone add-on available for Firefox. This addon allows users to store passwords internally through KDE Wallet manager (KWallet) instead of the default Firefox password manager.

Since the release of Firefox v57 and the migration from XUL based extension to WebExtensions, there has been no attempt to make a new add-on to support the new Firefox.

Konqueror and Falkon, the official web browser of the K Desktop Environment (KDE) features KDE Wallet manager (KWallet) to store sensitive passwords encrypted.

API

KDE Wallet Manager’s APIs trigger authentication events when the application makes a request through Desktop Communications protocol (DCOP), which is KDE’s primary interprocess communication (IPC) mechanism, which causes a password dialog box to be displayed for the application. This causes the password dialog box to be launched by the KDE daemon process. Users can choose either to cancel the dialog box which will terminate the application or to fill the password box in. If the password box is filled, the Wallet will automatically open. KDE Wallet Manager’s Desktop communications protocol (DCOP) can only be accessed locally because it is an interprocess communication (IPC) protocol that is processed over UNIX local sockets.^[4]

GUI

On KDE Wallet Manager’s GUI, users can manage every wallet and password assigned to them.

KDE Wallet Manager allows users to save or delete Wallets and users can identify which wallet applications should look in when attempting to access a stored password.

These are the lists of actions that users can take on the GUI of KDE Wallet manager (KWallet):

• Create new Wallet
• Change the default Wallet
• Lock the Wallet
• Store passwords to a Wallet
• Unlock the password of the Wallet
• Update the information on a Wallet
• View stored passwords in the Wallet

Wallets

The Wallet is a term for password storage used in KDE Wallet Manager software. Wallets can be created manually by the user or It is offered by dialogue when the user enters in a password on any KDE desktop environment or website. Once created, Wallet can store various passwords and It is controlled by one master password. This way users do not have to remember various passwords, instead, they can just manage them by memorizing one master password for the wallet. The default Wallet is named “kdewallet” and users can create more of their own if needed.

Managing wallets

Users can manage wallets on their own KDE Wallet Manager window. Packaging or combining wallets can be done by dragging and dropping. If the user wants to export information to other locations such as flash drives, the window allows for the user to choose whether to export data encrypted or not. Providing the master password, the user can similarly import the data encrypted.

Setting preference of wallets is also possible, user can set certain wallets to be the default wallet. The close wallet setting enables the user to close the wallet after:

• Close when unused for
• Close when the screensaver starts
• Close when the application stops using it

Encryption of the password

The data stored by the KDE Wallet manager can be encrypted in two major ways. The GNU Privacy Guard (GnuPG or GPG) algorithm is used if GnuPG Made Easy library is installed on the user’s Linux-based OS. If not, Blowfish symmetric block cipher algorithm is used.^[5]

Blowfish symmetric block cipher algorithm

KDE Wallet manager encrypts the data stored in the wallet using the Blowfish symmetric block cipher algorithm in CBC mode. To protect the user’s information, blowfish encrypted data is authenticated with the SHA-1 hashing algorithm.

KDE Wallet manager’s blowfish encryption provides faster encryption compared to Khufu, RC5, DES, IDEA, and Trip-DES. Blowfish encrypts at a rate of 18 clock cycles per byte in 32-bit microprocessors.

KDE Wallet manager’s Blowfish algorithm can be executed in memory within 5k, and a simple structure is easy to implement and easy to determine the strength of the algorithm. The algorithm is variable in key length, which can be long as 448 bites and it allows basic word addition and bit XOR operations.^[6]

GNU Privacy Guard encryption

Users can create a GNU Privacy Guard (GnuPG or GPG) based wallet to store extra-sensitive passwords. This requires users to install GnuPG Made Easy library. If the library is installed and once the software found GNU Privacy Guard (GnuPG or GPG), users will be asked to choose a key to use for a new wallet. User stil can encrypt passwords with Blowfish symmetric block cipher algorithm since GNU Privacy Guard encrtpytion library includes DSA/Blowfish symmetric block cipher algorithm.

Security of KDE Wallet manager

Using KDE Wallet manager (KWallet) may ease the management of the passwords but It does not provide greater security conditions to user's system. Instead of getting user's other passwords, attackers may get the master password for user's wallets through user's PC.

Since the directory of encrypted files of KDE wallet manager (KWallet) are located in predictable files, It might be vulnerable to viruses or worms those are programmed to aim password management system itself.

Known vulnerabilities

• The SHA-1 hash function that is used in KDE Wallet manager (KWallet) is cryptographically broken. Google and CWI Amsterdam have proved that two identical SHA-1 digest displays two different PDF content. Various companies, including Microsoft, has discontinued SHA-1 supports; however, KDE Wallet manager (KWallet) uses SHA512 in versions higher than 4.13 or with Pluggable authentication module or it uses SHA-1 hash function.
• "kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack."
• "fishProtocol::establishConnection in fish/fish.cpp in KDE kio-extras through 20.04.0 makes a cacheAuthentication call even if the user had not set the keepPassword option. This may lead to unintended KWallet storage of a password."
• "kwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC mode when encrypting the password store, which makes it easier for attackers to guess passwords via a codebook attack."
• "SHA-1 is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of SHA-1 in TLS 1.2. NOTE: this CVE exists to provide a common identifier for referencing this SHA-1 issue; the existence of an identifier is not, by itself, a technology recommendation."^[7]
• "An issue was discovered in password-store.sh in pass in Simple Password Store 1.7.x before 1.7.2. The signature verification routine parses the output of GnuPG with an incomplete regular expression, which allows remote attackers to spoof file signatures on configuration files and extension scripts. Modifying the configuration file allows the attacker to inject additional encryption keys under their control, thereby disclosing passwords to the attacker. Modifying the extension scripts allows the attacker arbitrary code execution."^[8]
• "GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other impact, when a victim imports an attacker's OpenPGP key, and this key has AEAD preferences. The overflow is caused by a g10/key-check.c error. NOTE: GnuPG 2.3.x is unaffected. GnuPG 2.2.23 is a fixed version."^[9]
• "A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18."^[10]
• "GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions with certain patterns that introduce a side channel, which allows physically proximate attackers to extract RSA keys via a chosen-ciphertext attack and acoustic cryptanalysis during decryption. NOTE: applications are not typically expected to protect themselves from acoustic side-channel attacks, since this is arguably the responsibility of the physical device. Accordingly, issues of this type would not normally receive a CVE identifier. However, for this issue, the developer has specified a security policy in which GnuPG should offer side-channel resistance, and developer-specified security-policy violations are within the scope of CVE."^[11]
• "Integer underflow in the ksba_oid_to_str function in Libksba before 1.3.2, as used in GnuPG, allows remote attackers to cause a denial of service (crash) via a crafted OID in a (1) S/MIME message or (2) ECC based OpenPGP data, which triggers a buffer overflow."^[12]
• "Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2.x through 2.0.16 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a certificate with a large number of Subject Alternate Names, which is not properly handled in a realloc operation when importing the certificate or verifying its signature."^[13]
• "mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "—status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes."^[14]
• "The integrity check feature in OpenPGP, when handling a message that was encrypted using cipher feedback (CFB) mode, allows remote attackers to recover part of the plaintext via a chosen-ciphertext attack when the first 2 bytes of a message block are known, and an oracle or other mechanism is available to determine whether an integrity check failed."^[15]
• "Heap-based buffer overflow in the ask_outfile_name function in openfile.c for GnuPG (gpg) 1.4 and 2.0, when running interactively, might allow attackers to execute arbitrary code via messages with "C-escape" expansions, which cause the make_printable_string function to return a longer string than expected while constructing a prompt."^[16]
• "GnuPG 1.4.6 and earlier and GPGME before 1.1.4, when run from the command line, does not visually distinguish signed and unsigned portions of OpenPGP messages with multiple components, which might allow remote attackers to forge the contents of a message without detection."^[17]
• "mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on file descriptor 2 to other programs that use the "—status-fd 2" option. For example, the OpenPGP data might represent an original filename that contains line feed characters in conjunction with GOODSIG or VALIDSIG status codes."^[18]
• "The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits."^[19]
• "kbx/keybox-search.c in GnuPG before 1.4.19, 2.0.x before 2.0.27, and 2.1.x before 2.1.2 does not properly handle bitwise left-shifts, which allows remote attackers to cause a denial of service (invalid read operation) via a crafted keyring file, related to sign extensions and "memcpy with overlapping ranges."^[20]

References

1. Zhang . Jie . Luo . Xin . Akkaladevi . Somasheker . Ziegelmayer . Jennifer . 2009 . Improving multiple-password recall: an empirical study . European Journal of Information Systems . en . 18 . 2 . 165–176 . 10.1057/ejis.2009.9 . 7244341 . 0960-085X.
2. Book: Gray . Joshua . Franqueira . Virginia N. L. . Yu . Yijun . 2016 IEEE 24th International Requirements Engineering Conference Workshops (REW) . Forensically-Sound Analysis of Security Risks of Using Local Password Managers . 2016 . https://ieeexplore.ieee.org/document/7815617 . Beijing, China . IEEE . 114–121 . 10.1109/REW.2016.034 . 978-1-5090-3694-3. 15971740 .
3. Toman . Zinah Hussein . Toman . Sarah Hussein . Hazar . Manar Joundy . 2019 . An In-Depth Comparison Of Software Frameworks For Developing Desktop Applications Using Web Technologies . Journal of Southwest Jiaotong University . 54 . 4 . 10.35741/issn.0258-2724.54.4.1 . 209057621 . 0258-2724. free .
4. Mulligan . J. . Elbirt . A. J. . 2005 . Desktop Security and Usability Trade-Offs: An Evaluation of Password Management Systems . Information Systems Security . en . 14 . 2 . 10–19 . 10.1201/1086/45241.14.2.20050501/88289.3 . 21253225 . 1065-898X.
5. Dudášová . Ludmila . Vaculík . Martin . Procházka . Jakub . 2021-12-29 . Psychologický kapitál v pracovní, klinické a školní psychologii: přehledová studie . Ceskoslovenska Psychologie . 65 . 6 . 558–574 . 10.51561/cspsych.65.6.558 . 245578091 . 0009-062X. free .
6. Book: Mousa, A. . 47th International Symposium ELMAR, 2005 . Data encryption performance based on Blowfish . 2005 . http://dx.doi.org/10.1109/elmar.2005.193660 . 131–134 . IEEE . 10.1109/elmar.2005.193660 . 953-7044-04-1 . 1334-2630 . 21814142 .
7. Web site: NVD - CVE-2005-4900 . 2022-05-27 . nvd.nist.gov.
8. Web site: NVD - CVE-2018-12356 . 2022-05-27 . nvd.nist.gov.
9. Web site: NVD - CVE-2020-25125 . 2022-05-27 . nvd.nist.gov.
10. Web site: NVD - CVE-2019-14855 . 2022-05-27 . nvd.nist.gov.
11. Web site: NVD - CVE-2013-4576 . 2022-05-27 . nvd.nist.gov.
12. Web site: NVD - CVE-2014-9087 . 2022-05-27 . nvd.nist.gov.
13. Web site: NVD - CVE-2010-2547 . 2022-05-27 . nvd.nist.gov.
14. Web site: NVD - CVE-2018-12020 . 2022-05-27 . nvd.nist.gov.
15. Web site: NVD - CVE-2005-0366 . 2022-05-27 . nvd.nist.gov.
16. Web site: NVD - CVE-2006-6169 . 2022-05-27 . nvd.nist.gov.
17. Web site: NVD - CVE-2007-1263 . 2022-05-27 . nvd.nist.gov.
18. Web site: NVD - CVE-2018-12020 . 2022-05-27 . nvd.nist.gov.
19. Web site: NVD - CVE-2016-6313 . 2022-05-27 . nvd.nist.gov.
20. Web site: NVD - CVE-2015-1607 . 2022-05-27 . nvd.nist.gov.