Copyright: Help File (C) 2002 by Michael Robinson


Contents
Mike Robinson's Password Vault Help

You can hit F1 on any screen to get to Help.

Getting Started

Program Configuration

Main Functions

Add / Edit Record

Clear Clipboard

Clipboard Tool

Delete Record

Delete / Wipe File

Export Records to File

Import Records to File

Options

Change Main Password

Logging

Restrictions

Web Tool

Emergency Recovery

Backing Up & Restoring

Security Information

General FAQ's

CRC

DOD Data Destruction Standard

RC4

SHA (Secure Hash Algorithm)

Twofish


Program Configuration

Your USER ID is stored in memory.  There is no need for you to remember it.  You may use anything you want for a User ID.

Your Main Password is the key to the vault.  Without it, not even the program designer can access your vault file.  Your main password must be 6 - 20 characters.  You must type the exact same text in the confirm field, so that you can ensure that you did not type it incorrectly.  You may change your main password later from the options menu.  Do Not Forget Your Main Password!

Logging is essential if you ever suspect someone is accessing your vault unauthorized.  If you have Log All Access enabled, you will not only see when all successful accesses occurred, but when & why other access attempts were denied.  You can limit the number of entries from 1 - 99.  More detailed information about the actual logging can be found here.

Restrictions are additional tools you can use to limit access to your vault.  Even with the correct main password & User ID, if a condition is enabled & not met, access can be denied.  These options can be changed later from the options menu.  Go here for more specific details on the restrictions.


Add Record
Add / Edit Record

   To Add a record, just push the add button on the main screen (shown at left).  If you want to Edit a record, double click on its description in the main listing.

The Description will be what appears in the main listing.  It is used in identifying your password.  It should be something that is descriptive and clearly relates to the password & username.  For example:  Online Banking, Stock Trading, Etc...  You must enter a description for every record in the Vault.

The Server/Website can be used to for reference as to where the location to enter the password is located.  You can click on the Web Tool on the main screen to go to the website referenced by this record.  Make sure to at least put the "www." before any standard web address, if you wish to use the Web Tool.

User Name is typically used to store a Login ID for the program or web page.  Though, this field can hold anything pertinent to the topic.

Password is the password you are storing.  The viewing options can provide more on-screen security.  Don't worry, the password will remain encrypted even while it is stored in memory.  You can use the Clipboard Tool on the main screen for easily pasting your password into another application.

Notes are anything you feel pertains to this record.  They can be multi-line comments.  It is strongly recommended that if you have to do something special to use the password, that you record it in this field.

Viewing Options control the way this screen is displayed.  With Gray Viewing Protection enabled, all the backgrounds of the entries are gray.  This makes it harder for someone looking at your screen from an angle to make out exactly what's on the screen.  With Mask Password Field, your password remains in * while it's on the screen, so others can't easily see what you have on the screen.  Make sure the password is correct the first time you enter it though.


Delete Record

  To delete a record, you must first have a record selected.  Then simply click on the delete icon on the main screen (as shown).

 You will then be prompted with the dialog box above.  Make sure that you are actually going to delete the correct record before selecting Yes to permanently delete the record.  If you made a mistake, and do not actually desire to delete the record, select No.

Note:  Sometimes Delete & Remove refer to the same thing in Password Vault.


Web Tool

  To use the web tool select a record then click on the web icon (picture shown).

You will be taken to the web address entered in the records server/website field, provided that you are connected to the internet and entered a correct web address.


Clipboard Tool

  To use the clipboard tool, on the main screen simply select a record and click on the icon (as shown).

The clipboard tool copies the password from the currently selected record onto the clipboard, so passwords can be easily pasted into any other application by holding Ctrl + V.

Warning:  While a password is on the clipboard, it is not encrypted.  Therefore, be sure to use the Clear Clipboard command before leaving your computer.  Password Vault will automatically ask if you want it to clear the clipboard before closing it, if something of a sensitive nature was posted there.


Clear Clipboard

To use Clear Clipboard, go to the Edit menu, then select Clear Clipboard, or alternatively just hit F5.

Because information such as passwords resides in the clipboard un-encrypted, it sometimes become necessary to clear the memory, so other users cannot just hit Ctrl + V and steal your password while you are not there.  To combat this, the Clear Clipboard command clears & overwrites the values of the Clipboard several times.  You will automatically be prompted to use this command before shutting down password vault, if you used the Clipboard Tool at all.


Restrictions

To get to the restrictions options, on the main screen go to the Edit menu, then options.  The restrictions box appears at the lower left.

The Require same Windows User Name is useful to prevent people on a different windows login name from accessing your account.  This is useful, if you have co-workers, etc. that use your same PC.  However, this function is primarily intended for Windows 2000, NT, and XP.  But it does offer minimal security in Windows 95/98.  The Default (which is recommended) is to leave this option turned on.  If you have no clue what this option does, leave it turned on.

Do Not Allow Exporting of Data will disable the export menu item from the main screen.  This prevents you or other users from inadvertently creating a password file that can be used on any computer with the proper password.  This option can be turned off by any user with the main password, so it does not offer full protection against exported files.

Allow Access Only at Certain Times is like a time lock for your vault.  Even with the correct password, your vault will not be able to be accessed if the time is not allowed for entry.  This is a wonderful tool if your vault is on a work computer, so after-hours access will not occur.  When a user is denied access for this, they are not told that it is a time-lock preventing them from access.  They will think that they have an incorrect password or something, and futilely continue trying to gain access.  It is important to remember that after selecting the check box that you click the "Set Access Times" button and set-up some hours for access.  On the hours screen, you are selecting hours to allow access (not the hours you are blocking it).


Change Main Password

To change the main password, first go to the Main Screen then select the edit menu, then go down to Options.  Next click on the Change Main Password Button.

Your Main Password is the key to the vault.  Without it, not even the program designer can access your vault file.  Your main password must be 6 - 20 characters.  To change it, you must type your current password to confirm you are authorized to make this big change.  Be sure to let everyone who is authorized to access this account know that the password has changed.  Your New Password & Confirm Passwords must match exactly to ensure that you did not type it incorrectly.  Do Not Forget Your Main Password!

Note:  Informing other users of a password change via e-mail or Instant Message is not recommended, as these forms of communication are not secure and will compromise the security of your vault.


File Export
Export Records to File

To export a file, on the main screen select the file menu, then select export file.  Alternatively hit Ctrl + E.  If the export file option is disabled, you will have to change the restrictions in the options menu.

Next, you will be taken to a box that prompts you to enter a file name for the exported file to be created.  If you select a file that already exists, you will be asked if you want to overwrite it.  Overwriting a file will delete (wipe) the current contents of the file, and store the encrypted vault in the file.

Automatically delete this file after import will prevent this file from being imported more than once.  It will automatically wipe this file clean using the Department of Defense Data Destruction Method.  If you don't have this option checked, the user importing the file will be asked if they want to delete it for security.

File Importation Impossible after a Certain Date will prevent the file from being opened after a certain date.  If, someone tries to open one of these files after the date, it is automatically destroyed to prevent someone from attempting to hack into it.  This option is only recommended for high security exports.  Also of note, the default date is today's date...be sure to put a date that is far enough in the future for you it to be feasibly imported.  The program will make sure you do not select a date that is in the past.

After you have created the file, a message box will appear with a CRC value that has been copied to the clipboard.  CRC values ensure that a file has not changed.  Match the value that appears with the one that is displayed during importing and your file is safe.  To paste the CRC value in another application, hit Ctrl + V.

Note:  If you are going to send an exportable vault file & it's CRC via e-mail, it is recommended that each have their own separate e-mail to prevent tampering further.

Warning:  Unlike the vault file stored on your hard drive, an exportable vault file can be opened up by any copy of Password Vault, where the user knows the password.


File Import
Import Records to File

To import a file, on the main screen select the file menu, then select import file.  Alternatively hit Ctrl + I.

Warning:  If you attempt to import a file that had an expiration date, it will automatically delete itself without warning.

You will first be asked to locate the file you want to import.  If the file does not exist, you will receive an error, and be returned to the main screen.

You may choose to Merge with or Replace your current vault file on your hard drive.  If you replace your vault, your current vault will be gone and non-recoverable.

Note:  Be sure to check the File CRC before importing the file.  If the CRC value has changed, the file could have been tampered with.

Once the importation process has been completed, the file will either self destroy itself or ask you if you want to destroy it, depending on the options selected at start up.   It is highly recommended that you delete the file, if no one else is going to use it.


Delete / Wipe File

To Delete / Wipe a File, on the main screen select File and then Delete / Wipe File.  Alternatively, you can hit Ctrl + D.

First, you will see a box prompting you for a file you wish to delete / wipe.  Take great care to select the correct file.

If you select Yes, make sure you truly do not need that file ever again.  When you select to wipe a file, it is overwritten multiple times making it unrecoverable to most software file recovery systems.  The process Password Vault uses to destroy your file exceeds Department of Defense Standards for the destruction of non-classified data.

Warning:  Advanced Software Recovery tools may still be able to determine the file name for the file that was deleted, so make sure the name of the file isn't too compromising before deleting.

Warning:  Out data destruction method is strong enough to prevent recovery by most software recovery tools by most professionals.  However, this method is definitely not strong enough to keep your secrets away from experts in data recovery, who actually analyze your hard drive outside of your computer.  Though, the recovery by these experts will be extremely time consuming & costly.  Also of note, that government agencies do have methods that would most likely bring back your data.


Options

To get to the Options screen, on the main screen select Edit then Options.  Alternatively you can just hit F5.

Your USER ID is stored in memory.  There is no need for you to remember it.  You may use anything you want for a User ID.

Change Main Password

If you have Logging enabled, you have to select a limit for the entries in your log file.  You may log 1 - 99 entries.  Your log file will also show attempted entries, and why they were denied.  To view your log file, select View Log File.  You may also go here for more information on the Log File.

Restrictions


Logging

•	To get to the Logging Options, on the main screen select Edit then Options.

•	To view the Log, on the main screen select Edit then Options and finally, View Log File.

Clear will delete / wipe your log file, and clear the current listing.  Recovering a cleared log file is not possible!

Print will bring up a dialog box with some printing options for you.  This command is very useful if you are trying to track down an unauthorized entry to the Vault.

OK returns you to the options screen.


DOD Data Destruction Standard

In 1995, the United States Department of Defense (DOD) released a document with a standard for the destruction of non-classified data.  Password Vault exceeds this method, though the exact specifications of Password Vault will remain a secret for security measures.

The DOD method will write data through the file multiple times, before finally deleting the file.  This will make the contents of your file unrecoverable to almost all software recovery tools.  Though, if an expert or government agency physically removes your hard drive and examines it under a microscope, they may still recover you data.  However, such possibility is usually remote and very costly, and you can safely conclude that Password Vault's destruction will be sufficient for most home & corporate needs.

The DOD standard was released in the document: National Industrial Security Program Operating Manual, NISPOM (also known as US DOD 5220.22-M).

This document is available online at:  http://cryptome.org/nispom/nispom.htm

Warning:  The DOD method of data destruction will wipe a file clean of all sensitive data, but advanced software recovery tools may still be able to retrieve the name of the file that was deleted.


Twofish

Twofish is a block cipher owned Counterpane Labs. It was one of the five Advanced Encryption Standard (AES) finalists.  It is believed that Twofish was not selected simply because the winning algorithm did not have as significant decrease in performance in limited memory devices (like Handheld & Wireless).  This is of no concern to the users of Password Vault, being as it is run on a Windows PC.  The Twofish algorithm is very secure, and is favored over the AES by some.  Also of note is that one of the developers is Bruce Schneier, who developed the Blowfish algorithm that almost became a common & stronger substitute for the Data Encryption Standard.

Twofish was developed & analyzed by:  Bruce Schneier, John Kelsey, Doug Whiting, David Wagner, Chris Hall, and Niels Ferguson.

The Twofish website can be found at:  http://www.counterpane.com/twofish.html


RC4

RC4 is a stream cipher designed by Ronald Rivest for RSA Data Security (now RSA Security) in 1987.  This cipher has been widely used in many commercial applications including: Oracle SQL, Microsoft Windows, many secure communications, and the Secure Sockets Layer (SSL).  RC4 has almost become a pseudo-standard for data encryption over the internet, because it can be expected to run very efficiently.  While this cipher is considered secure, minor weaknesses do appear when encrypting gigabytes of data.  This does not pose a threat, because most Vault files will never reach such a size.

The main RC4 web page can be found at:  http://www.rsasecurity.com/rsalabs/faq/3-6-3.html


CRC

Cyclic Redundancy Codes (CRC), are a unique description of a file.  Theoretically, no two files will have the exact same CRC, unless they are the same exact file.  By using a CRC, you can verify that the file you have received is exactly the same as when it was created & transferred to you.  This prevents people from tampering with your file, without your knowledge.  In addition, it ensures that the data was correctly transferred, since transmission errors can & will occur.

Make sure to check the CRC of all the Vault files that you import.  This will ensure that no one has altered your vault file to possibly corrupt your Vault or computer.  Only import files from people you know & trust, with CRC checking!

Note:  Many files within Password are automatically protected by CRC.  For example, if your Vault CRC does not match the last time you ran the program, you will be notified.


SHA

The Secure Hash Algorithm (SHA) was originally developed by the United States National Security Agency (NSA), and was later released to the National Institute of Standards & Technology (NIST) for adaptation as a standard for hashing.  It is also commonly referred to as the Secure Hash Standard (SHS).

Hashing is similar to a one way encryption.  When data is fed into it, it produces a message digest (which is basically like encrypted data).  However, with a message digest there is no possible way to retrieve the original data.  In addition, each hash is unique.  Only one combination of data will produce the exact hash.  By using a Hash, you can confirm that passwords are the same without actually storing a retrievable password in memory.  Other uses of hashes are digital signatures, and to ensure file integrity in a way similar to CRC's.

SHA-1 was originally approved as a standard in 1995.  In 2001, more advanced versions of the SHA were adapted as standards as well.  In order to further maintain security, we will not reveal the exact implementation of the SHA used in Password Vault...besides saying that it meets the 2001 guidelines.

The 2001 SHA document can be found here:  http://csrc.nist.gov/encryption/shs/dfips-180-2.pdf


Security FAQ's

Is Password Vault secure enough for me to use?

Generally speaking, yes...Password Vault is very secure and should be suitable for most home & corporate use.  However, if you were a Fortune 500 company or an extremely wanted Felon / Terrorist, I would not recommend using this.  With as secure as Password Vault is, many of the security measures can be undone by government agencies and experts.  This is true for almost all encryption programs, anyone whom tells you otherwise is a liar.  Though, Password Vault includes enough protection to withstand avid computer veterans, and many hackers.  One important thing to remember though, You assume all liability for any damages, as the author take's no responsibility for any security weaknesses, lost business, lost money, etc..even if the author has been informed of such possibilities.  If you do not like this....tough, even Microsoft lists something similar to this in all their products.

How do I report a security flaw?

Send an e-mail to Mike@Mikeslife.com and it may get fixed in two years (no joke)!  Also, do not expect a reply to your e-mail.  Though, do note that your e-mail will be strongly appreciated.

Does Password Vault meet all government standards?

No, Password Vault exceeds many of the Standards for non-classified data.  Though, in some area's we chose not to follow the standards to produce what we thought would be a better program.  For example, we selected Twofish instead of the AES winner, Rijndael.  Basically, if you are a member of a government agency you can use this, but it doesn't fully coincide with all of your standards.

What encryption algorithms are used in this program?

Twofish and RC4 are in use by this program.

What hashing algorithm is in use by this program?

The Secure Hash Algorithm (which version will not be revealed, to increase security).

How secure is your file delete / wipe method?

See this page for more details.

Can I possibly get a copy of the source code to verify that this program is secure?

No, that defeats the purpose.  By rendering you a copy of the source code, the security countermeasures that are built in will have been greatly weaken.  Though, we will say that the encryption routine source codes are freely available online, and have been proven secure.  In addition, many of the government standards that Password Vault meets / exceeds can be found in government documents online.

Does Password Vault protect itself against debuggers & disassemblers?

Certain methods to protect against the most common debuggers & have been placed in Password Vault.  This should be sufficient to prevent most hackers & crackers from getting to your vault file.  The security incorporated in Password Vault exceeds most other programs to prevent this.  However, as a seasoned cracker would tell you, "f it can be run on a computer, it has the potential of being cracked."  Though, the possibility of this happening will greatly be reduced if you lock your computer from unauthorized use, use security options in Password Vault, and take normal security measures.  Do Not Attempt to Run a Low Level Debugger or Disassembler at the same time as Password Vault.

I have a question not listed here.

You can try e-mailing Mike@Mikeslife.com, but you will not likely get a response.  Though, your question is appreciated.


Backing Up & Recovering

Important:  Back Up regularly, it is your only chance of recovery!

The Vault File on your computer is copy protected.  It will not work on any other computer.  Even if you reformat your hard drive, you will not be able to use the same vault file.  Therefore, just copying the main vault file is not enough to recover from.

In order to Back Up, you will need to Export your Vault to a File regularly and store the password for your back-up in a safe place, as well as keep the back up file in a safe location.  Exported files can be imported on any copy of Password Vault, as long as you enter the correct password.

Also useful to backing up your data is your Password Vault registration number.  This can be found by going to the about screen.  This is easily accessible by going to the Help menu on the main screen and selecting About.  Your registration number will appear right below the copyright notice.  (Example as shown)

In order to Recover your data, you must have first backed up.  We are sorry, but there is absolutely no way to recover a Vault file on a different computer from the one that created it, unless it was an Exported Vault file.

1)  Install a new clean copy of Password Vault to your hard drive.

2)  If you receive the message below when hitting Save on the configuration screen, make sure the password you entered was the same as your old password for the Vault, if it was not select cancel and enter it as such.  Once you have entered the same password as you had before, select No.  If you are absolutely certain you cannot remember your old Vault password, then you can select yes & start a new Vault file from the backup you have.

3)  After the program restarts and you log-in. Import the Data from a File.  If your vault file is currently corrupted, be sure to select to replace your current Vault.  Remember, if you merge a file with the current vault, you can always later delete the bad records.

4)  Hope everything went well, and you have recovered successfully.

Note:  If you had major restoration problems, then your registration number may help.  However, this number may only come in handy if you have your original Vault file, and you contact Michael Robinson.