Figaro's Password Manager 2 v0.90
$mail ="Hello!
I send answer to your query about FPM2.
After user enter master password, FPM2 generate new 128 bit salt and use it with master password in PBKDF2 using HMAC-SHA-256 function to generate 256 bit master encryption key. This key is used for initializing SHA-256 crypto algorithm, after that plaintext master password and master encryption key is secure wipe out from memory.
Now user enter some password items and FPM2 encrypt only password entry in memory, other data entry (as name, url, category) remains in clear text. When you select save, FPM2 compute SHA-256 checksums of all data entry and store this checksum to fpm file in header and also in header store current salt. Then encrypt all data entry a save it to file.
When FPM2 loading password file, get salt and checksum from header and ask for password. From entered password and salt compute master encryption key and decrypt all data entry. Then compute SHA-256 checksum of that decrypted content and compare with checksum from header. If checksums equals then password is correct, if no then ask user again for other password.
So as you see, master password is not stored anywhere and after each save is used another salt. Items password is crypted in memory and is only decrypted when user select copy to clipboard or want view it in edit window.
I hope this help you understand how FPM2 works. If you have another question, you can ask me and I try best answer you :)
With regards A. Koval
";
print nl2br($mail);
?>
(c) 2008-2020 Aleš Koval
Last update: 13.02.2020