1 of 82

TwoKey — Password Manager� with a Physical Access Token

Under supervision of: Dr. Karim Emara � TA. Abdulrahman Ali�

Team Members:

  • Ahmed Yasser Abdullah
  • Danya Rizk Hamouda
  • Omar Hesham Fathy
  • Nouran Khaled Ibrahim
  • Ahmed Wael Elmayyah

2 of 82

Table of Content

  • Introduction & Problem Definition
  • Existing Solutions
  • TwoKey’s Objective
  • System Architecture
  • Demo
  • System Design and Implementation
  • System Analysis
  • Tools Used
  • Conclusion and Future Work

3 of 82

Introduction & Problem Definition

4 of 82

The Problems: Passwords

01

​

03

Image credit: tekmanagement.com, hackingarticles.in

5 of 82

How many unique passwords do you have?

6 of 82

7 of 82

8 of 82

How many of you got this email before?

9 of 82

10 of 82

11 of 82

Existing Solutions

12 of 82

Existing Solutions: Password Managers

Old, local solutions

​

Newer, cloud-based solutions

​

KeePass

KeePassX

KeePassXC

GNOME-Keyring

Enpass

13 of 82

Existing Solutions: 2FA - The Factors of Authentication

Something you are

Something you have

Something you know

*There are also 2 � other factors: �- Somewhere you are �- Something you do

14 of 82

Existing Solutions: 2FA

Image credit: zukotech.com

15 of 82

The Problems of Existing Solutions

Research credit: https://www.ise.io/casestudies/password-manager-hacking/

​

16 of 82

17 of 82

TwoKey’s Objective

18 of 82

Project Objective: Secure Programming

  • TwoKey sanitises and scrubs memory.
  • No artifacts(allocations) are left behind in memory.
  • TwoKey is secure from programming attacks (buffer overflows, ROP, etc..)

19 of 82

Project Objective: Secure Communication

  • Only encrypted data is transmitted between the modules.
  • No decryption keys are transmitted between the modules of the project.

20 of 82

Project Objective: Strong Passwords

  • Users are able to generate random strong passwords.
  • TwoKey warns the user if a weak password is being saved.
  • Users can add, edit, and remove passwords from the server.

21 of 82

Project Objective: Protection from 2FA/SMS Attacks

  • Using a unique(per user) physical USB hardware token as the 2FA.
  • This verifies that the owner of the account is the one logging in.

22 of 82

Project Objective: Trust

  • All of TwoKey’s code is licensed under GPLv3, and available as free, open source software at github.com/satharus/TwoKey.

Image credit: publicdomainvectors.org

23 of 82

Target Consumer

Convenience

Security

24 of 82

Introducing: TwoKey

A minimal, cloud-based, secure password manager with a physical hardware-based 2FA.

​

​

​

​

25 of 82

System Architecture

26 of 82

TwoKey: System Architecture

  • The desktop app acts as the middle-man between token, the server, and the extension.

​

​

Browser�Extension

Desktop App

Hardware Token

Server

27 of 82

Modules from Security Standpoint

Attack

Module

Security Practice

Brute Force

Desktop App, Server-Side

Strong and different password for each account.

Phishing

Browser Extension

Fill password when the service domain is verified with the server.

Dictionary/Rainbow Table Attack

Desktop App

PBKDF is used for key stretching and to make password cracking difficult.

Less Common Interfaces

Desktop App, Browser Extension

Hardware tokens are always checked for verification.

GSM Sniffing

Hardware Token

No SMS Security Codes are used as a 2FA. The only 2FA is the USB token.

MITM Attack

Desktop App, Browser Extension, Server-Side

Credentials are encrypted and transferred securely between modules and memory is sanitized.

Hardware Token

Authentication token and encryption keys never leave the chip on the USB device.

Replay/Playback Attack

Hardware Token, Server-Side

A random challenge is always sent each time for authentication.

Desktop App, Server-Side

Random session keys/tokens.

Insecure Programming Attacks

The Entire Project

Secure programming to avoid common vulnerabilities such as BOF, ROP/Ret2LibC, Format String Attacks, etc...

28 of 82

Demo

29 of 82

TwoKey: Demo - Registration

30 of 82

System Design and Implementation

31 of 82

Modules of TwoKey

  • Desktop App
  • Hardware Token
  • Browser Extension/Plugin
  • Server Backend and Deployment

32 of 82

Modules: Desktop App

33 of 82

TwoKey: Desktop App - UI/UX

  • Using the Qt Application Framework, the UI was designed

34 of 82

TwoKey: Desktop App - UI/UX

  • Dynamic scalable UI
  • Tray icon for a more intuitive and convenient UX
  • Consistent on all platforms

35 of 82

TwoKey: Desktop App - Password Generation

  • Password strength is assessed based on four factors:
    • At least 11 characters long.
    • A mix of lowercase [a-z] and uppercase [A-Z] characters
    • At least one special character: !@#$%^&*
    • At least one numeric character [0-9]

36 of 82

TwoKey: Desktop App - Data Encryption

  • Decrypts the received credentials in memory, and cleans them after finishing what is required (ex: login).
  • Derives the encryption key from the entered master password.

Key Derivation Function�PBKDF2HMAC

Master Password

Salt�(added bytes)

Number of Iterations�(10,000)

New Derived Key

37 of 82

TwoKey: Desktop App - Secure Programming

38 of 82

TwoKey: Desktop App - Hardware Communication

  • Auto detecting if the token was plugged in or out.
  • Sending a sequence of bytes to the token.
  • Receiving a sequence of bytes from the token.

39 of 82

TwoKey: Desktop App - Hardware Comm. (Windows)

  • USB Device Notifications
  • QAbstractEventFilter

QAbstractEventFilter

Sources: https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-registerdevicenotificationw

https://doc.qt.io/qt-5/qabstractnativeeventfilter.html

​

​

USBEventHandler

40 of 82

TwoKey: Desktop App - Hardware Comm. (Linux)

  • libudev and libusb
  • QTimer

Sources: https://www.freedesktop.org/software/systemd/man/libudev.html

https://libusb.info/

​

​

​

41 of 82

TwoKey: Desktop App - Hardware Communication

42 of 82

TwoKey: Desktop App - Hardware Communication

43 of 82

TwoKey: Desktop App - Browser Extension Comm.

  • Send data from the browser extension to the desktop app.
  • Receive data from the desktop app.
  • Do so without slowing down or halting the UI.

Sources: https://doc.qt.io/qt-5/qabstractnativeeventfilter.html

https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Native_messaging�

​

​

​

44 of 82

TwoKey: Desktop App - Browser Extension Comm.

  • Using QThread and a minimal web server, the communication worked.

TwoKey Main Thread [0]

HTTP Server Thread [1]

Event Handlers in Thread 0

Sources: https://doc.qt.io/qt-5/qthread.html

https://github.com/rxi/sandbird

​

​

45 of 82

TwoKey: Desktop App - Server Communication

  • Using QNetworkRequest and QNetworkAccessManager, encrypted traffic is transferred between the desktop app and the server.

Sources: https://doc.qt.io/qt-5/qnetworkrequest.html

https://doc.qt.io/qt-5/qnetworkaccessmanager.html

�

​

​

​

46 of 82

Modules: Hardware Token

47 of 82

TwoKey: Hardware Token - Hardware Communication

  • Communicates with the desktop app using a USB port (Arduino Nano).

48 of 82

TwoKey: Hardware Token - Hardware Communication

  • Trying to use an ATtiny failed, as it doesn’t support USB Serial and has a very small ROM which couldn’t handle the AES code in the .text section.

49 of 82

TwoKey: Hardware Token - Security

  • Keys never leave the token itself.
  • The token uses 128-Bit AES encryption with a unique key and serial number per user.

50 of 82

Modules: Browser Extension

51 of 82

TwoKey: Browser Extension - Architecture

⓿ Master password�� Email

Browser�Extension

Desktop App

❶ Request Tab Info

❷ Tab Info

❸ URL

❹ Credentials

​

Browser

52 of 82

TwoKey: Browser Extension - Autofill

  • Auto filling the credentials in websites.
  • Allowing the user to choose alternate credentials for the same website.
  • Was a huge challenge due to poor documentation and deprecated APIs.

53 of 82

TwoKey: Browser Extension - UI

  • The user can log in from the extension itself and it will handle the communication with the desktop app.

54 of 82

Modules: Server Side

55 of 82

TwoKey: Server-Side - Registration

  • Link serial number of the device with the encryption key

​

​

Serial no.

Physical ID

56 of 82

TwoKey: Server-Side - Login/2FA

​

  • Username enumeration prevention
  • Save login attempts in database (JWT)

​

57 of 82

TwoKey: Server-Side - Authentication

​

  • Token-Based Authentication (JWT)

58 of 82

TwoKey: Server-Side - Secure Communication

  • How does it work ?

​

59 of 82

TwoKey: Server-Side - Web Hosting

  • Using Digital Ocean

​

60 of 82

TwoKey: Server-Side - Secure Communication

  • Applying SSL/TLS and DDoS Mitigation using Cloudflare

​

61 of 82

TwoKey: Server-Side - Secure Communication

  • Qualys SSL Labs Test Results

​

62 of 82

TwoKey: Server-Side - Secure Communication

​

  • HTTPS - Secure Communication

​

63 of 82

TwoKey: Server-Side - Multiple Concurrent Connections

  • Deploy uWSGI/Flask with Nginx

​

Desktop App

​

​

​

​

​

​

​

​

​

​

Invoke the callable object

Unix socket

Unix socket

Request from client

Request from response

Reverse Proxy

64 of 82

TwoKey: Server-Side Functionalities - Database

  • The user’s data is stored encrypted in the database�Before:������After:

​

65 of 82

System Analysis

66 of 82

TwoKey: System Analysis - User Features

67 of 82

TwoKey: System Analysis - Session Initialisation

Server

Hardware Token

Stored/Spec:

- 2FA Key

- Master Password Hash

- Encrypted Credentials

- Can generate random� challenges

- Can encrypted any� generated challenge

Desktop App

❶ Username, master password hash

❷ Random challenge

❺ Encrypted challenge

❸ Random challenge

Stored/Spec:

- 2FA Key

- Can encrypt the given

challenge with a unique key

❹ Encrypted challenge

❻ Session granted

68 of 82

TwoKey: System Analysis - Session Initialisation

69 of 82

TwoKey: System Analysis - Credentials Retrieval

Browser�Extension

Server

Desktop App

❷ URL for service, session token

❸ Credentials for the URL

❹ Credentials

❶� URL

​

Knows:

- Master Password

User

⓿ Browses a URL, already signed in

⓹ Extension autofills the form

70 of 82

TwoKey: System Analysis - Desktop Class Diagram

71 of 82

Tools Used

72 of 82

Used Tools and Frameworks

  • Desktop App
    • Qt Application Framework (qt.io)
    • C++11 (isocpp.org/wiki/faq/cpp11)
    • Win32 APIs (Ex: docs.microsoft.com/en-gb/windows/win32/devio/registering-for-device-notification)
    • Sandbird (Embeddable HTTP Server) by rxi (github.com/rxi/sandbird)
    • libudev (freedesktop.org/software/systemd/man/libudev.html)
    • libusb (libusb.info)
    • OpenSSL (openssl.org)
  • Hardware Token
    • AESLib (github.com/DavyLandman/AESLib)
    • Arduino Nano (store.arduino.cc/usa/arduino-nano)
    • Arduino IDE (arduino.cc/en/guide/windows)

73 of 82

Cont.: Used Tools and Frameworks

  • Browser Extension
    • WebExtension Javascript APIs (developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/API)
    • Browser Extension APIs (developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions)
    • Javascript, HTML, CSS (w3schools.com)
  • Server Backend
    • Python 3 (python.org)
    • Python Flask (pypi.org/project/Flask)
    • pyaes (pypi.org/project/pyaes)
    • MongoDB (mongodb.com)
    • CloudFlare DDoS Protection and SSL (digitalocean.com)
    • Digital Ocean Cloud Hosting (cloudflare.com/en-gb)
    • .tech domain name (get.tech)
    • Nginx (nginx.org/en)

74 of 82

Conclusion and Future Work

75 of 82

TwoKey: The Big Picture

Browser�Extension

Desktop App

Hardware Token

Server

�[0]�TwoKey(GUI)�

[0]�USBCommunicator*��USBEventHandler

[1]�BrowserExtensionCommunicator

[0] - Main thread , [1] - Secondary Thread�*Creates a thread for each event handling.

�[0]�BackendClient�

On tab update or login

76 of 82

TwoKey: Future Work

  • Auto filling credentials in native apps
  • Integration with data breach notification services such as havibeenpwned.com
  • The use of hardware-base securing of application data (e.g. Intel® SGX)
  • Physical tamper protection
  • Adding NFC to the token to support mobile phones
  • Adding Biometrics as a third factor of authentication

Image credit: fierceelectronics.com

77 of 82

TwoKey: Desktop Application

  • Auto Filling Credentials in Native apps
  • Reminding users to change their passwords
  • Integration with service for checking whether personal data has been compromised by data breaches (such as havibeenpwned.com)
  • Employing the use of hardware-based features for securing application data and binaries (like Intel® SGX)

Image credit: fierceelectronics.com

78 of 82

TwoKey: Hardware Token

  • Adding a elegant cover and a suitable casing for a modern look and physical tamper protection support
  • Improving AES 128bit to be AES 256bit
  • Integrating a physical HSM
  • Adding NFC to the token to support mobile phones

HSM

Image credit: fierceelectronics.com

79 of 82

TwoKey: Browser Extension

  • UI Enhancement
  • Website Certificate Check
  • Unlock with Biometrics
  • Launch a website from history

80 of 82

TwoKey: Server Side and Infrastructure

  • Adding multiple servers for load balancing and backup
  • Applying system administration such as regular backups

Server 1

Server 3

Server 2

81 of 82

TwoKey: Additional Modules

  • Enabling TwoKey’s hardware token as an option of 2FA without having to use TwoKey’s software itself by creating an API for service vendors

82 of 82

Thank you!