TLDR Tech / InfoSec
How Bitwarden Encrypts and Decrypts Secrets
Grinberg reverse-engineered Bitwarden's vault cryptography from the Bitwarden and Vaultwarden source, documenting the format 2.{iv}|{ciphertext}|{mac} where ciphertext uses AES-256-CBC with PKCS#7 padding and the MAC is HMAC-SHA256 over iv || ciphertext. The 64-byte master key splits into a 32-byte AES key and a 32-byte MAC key, while the wrapping key derives from PBKDF2-HMAC-SHA256 over the passphrase salted with the email at 600,000 iterations, then expanded into encryption and MAC subkeys via HKDF-Expand using the literal context strings enc and mac. Defenders should treat this as a roadmap for offline vault decryption from a stolen Vaultwarden SQLite file: passphrase strength and PBKDF2 iteration count are the only barriers once the encrypted master key is exfiltrated, so audit KDF iterations, consider migrating to Argon2id, and monitor Vaultwarden DB access paths.
Read the full story