“Midbar is my attempt to learn from the mistakes made by others (and later from my own mistakes) to make a better password vault.
After making several different versions of Midbar, improving the encryption algorithm, improving the way it handles the PS/2 keyboard, and just making it more user-friendly, I realized that even with all these improvements, one thing is still missing - the ability to back up your data without literally hacking the device.
And so, I’ve decided to fix that “inconvenience” in the Midbar V5.0 by making it store user data on an SD card.
In case you want to know why I called this project Midbar - Midbar (מדבר) is a Hebrew word that means “pasture, ” “uninhabited land, ” “wilderness, ” “large tracts of wilderness (around cities), ” “desert.” I had two reasons for choosing the word Midbar as the name of this project. First - while working on my previous projects, I noticed that the so-called “device that keeps your personal data secure in an encrypted form” market is pretty much a “desert around the oasis of the password manager market.” Second - I couldn’t find a better word to describe that project. At first, I wanted to call it a “Password Vault, ” but then I realized it’s more than just a password vault. So, I just called it Midbar!
The “3DES + AES + Blowfish + Serpent” encryption algorithm in cipher block chaining mode first appeared in the Midbar V2.5. And since then has been utilized by the Midbar (Raspberry Pi Pico Version),Midbar V3.0,Midbar V4.0,KhadashPay V2.0,Midbar (Raspberry Pi Pico Version) V2.0, and KhadashPay V2.0 (Raspberry Pi Pico Version).
Although the “3DES + AES + Blowfish + Serpent” encryption algorithm ain’t exactly what I would call “a cryptographically weak encryption algorithm, ” operating it in a weird derivation of the ECB mode, the way it was done by the Midbar V2.0 wasn’t the best idea that I had. Even though that wouldn’t’ve allowed the attacker to produce the legitimate ciphertext by swapping the blocks within the ciphertext, an attacker could still make a legitimate ciphertext by replacing the nth block of the ciphertext N1 with the nth block of the ciphertext N2. To fix that vulnerability (instead of just notifying the user that the decrypted ciphertext might’ve been forged), I made the “3DES + AES + Blowfish + Serpent” encryption algorithm work in CBC mode. So, if an attacker replaces a block of ciphertext, it spoils not just that block but also the subsequent one.
I’ll be honest with you, the bit-flipping attack “kinda works, ” but I doubt that it would ever go unnoticed because of the “HMAC-SHA256”-based integrity verification feature.
And let’s not forget that this encryption algorithm performs the operation called superencryption.
As defined by NIST, superencryption is an encryption operation for which the plaintext input to be transformed is the ciphertext output of a previous encryption operation.
Such organization of the encryption algorithms makes a combined encryption algorithm that is at least as strong as the strongest one in the cascade, has a longer key, might be more resistant to some attacks, and might produce a ciphertext with higher entropy. Anyway. It won’t hurt to have an additional layer of security (or several of them).
And by the way, out of all encryption algorithms utilized by the Midbar V5.0, the “3DES + AES + Blowfish + Serpent” is the only algorithm that works in CBC mode. Beware of it!”