Title: I&#x27;ve been a long-time user of KeePass. I inspected its 2.x .NET source code today and quickly noticed the following issues which I find quite concerning:<p>The kdbx database is encrypted with AES in CBC&#x2F;PKCS7 mode <i>without</i> proper authentication. HMAC is nowhere to be found in the code, other than when used for sha1-totp. There are SHA2 hashes that seem to guard the integrity of ciphertext, while these might catch a typical file corruption they will not prevent malicious tampering. Even if the hashes are used prior to encryption, that&#x27;s still MtE - not EtM.<p>KeePass likely does not have an online threat model, so attacks like Padding-Oracle might not be applicable, but a lack of AEAD is IMHO highly concerning because it indicates that the author(s) are winging it when it comes to doing crypto right.<p>Byte array comparisons are done with this function from MemUtil.cs:<p><pre><code>		public static bool ArraysEqual(byte[] x, byte[] y)
		{
			&#x2F;&#x2F; Return false if one of them is null (not comparable)!
			if((x == null) || (y == null)) { Debug.Assert(false); return false; }

			if(x.Length != y.Length) return false;

			for(int i = 0; i &lt; x.Length; ++i)
			{
				if(x[i] != y[i]) return false;
			}

			return true;
		}
</code></pre>
There are many other questionable patterns, code smells, and &quot;I-invented-it&quot; approaches that indicate a non-expert .NET programming skill. They can&#x27;t even implement a Singleton correctly (see CryptoRandom.cs).<p>Has anyone ever done a security audit of KeePass 2.x or does everyone just believe that it&#x27;s &quot;good enough&quot;?<p>P.S. None of this detracts from the fact that KeePass is a very useful, free utility with a lot of effort put into it. I thank all contributors for making&#x2F;improving it over the years.
Upvote: