nilsteampassnet/TeamPass — Issue #38: Feature Request: user encypted salts
Author: vx-github
Created: 2012-02-09 09:29:12+00:00
State: open

As mentioned in: http://www.teampass.net/how-passwords-are-encrypted/#comment-782
(A follow up of: http://www.teampass.net/how-passwords-are-encrypted/#comment-761)

Ever worked with LUKS / disk encryption (http://code.google.com/p/cryptsetup/)? The salt used for the disk encryption is encrypted with a password. Several passwords can coexist. A copy of the (different) encrypted salts is saved in the header.

If you limit user / password creation to one user (eg. admin), all users can have their own encrypted salt with their password. The salt is the same one used for encrypting keys in de database that are used by the team. Changing a user password can only be done by the user itself or the admin (an new version of the encrypted salt has to be created). Creating a new salt will result in generating new passwords for all users (and reencrypting the contents in the database).