Add support for Kaspersky Vault

[Mrincred]

Feature request to add cracking for support of the .kde file extension of Kaspersky Vault. Details of the vault can be found at the below links.

https://support.kaspersky.com/11404
https://fileinfo.com/extension/kde

[kholia]

No real technical information (e.g. KDF, file layout) is available on those links (or on the internet?). This task will likely involve non-trivial amount of reverse engineering work.

[kholia]

One of the products supporting this stuff, Kaspersky PURE 3.0, was EOL'ed in 2016.

[Mrincred]

Kaspersky PURE 3.0 EOL'ed but it has been permanently added to Kaspersky Total Security 2016, Kaspersky Total Security 2017, and future Kaspersky products.

[kholia]

Thanks for this information. Since, it is a relatively obscure proprietary file format, I don't think that anyone will volunteer to add such support anytime soon.

[magnumripper]

Since, it is a relatively obscure proprietary file format, I don't think that anyone will volunteer to add such support anytime soon.

I agree, although if anyone does a bit of research or reverse-engineering we'd likely be interested to help, try theories or just act as your rubber duck.

BTW, from https://support.kaspersky.com/11404:
"Vaults are encrypted with the 256-bit Advanced Encryption Standard (AES) block cipher with the effective key length of 56 bit."

That's an odd, and short, key length these days. I wonder what that tells us.

[Mrincred]

I hope this bit of information helps.

Just from searching the product forum I found, "encrypted with the AES XTS 256 block cipher with the effective key length of 56 bit."

https://support.kaspersky.com/12731

[kholia]

What about the details of the file format, KDF (key derivation function), and the password verifier involved? Someone would need to reverse-engineer all these low-level exact details. Without such work, there won't be any progress on this task.

[BrianEARTH]

Hi ! Does anyone has investigated further on this .kde KryptoStorage Kaspersky format please ?

[solardiz]

@BrianEARTH As far as I'm aware, no progress on this has been made, and I wouldn't expect it to be made unless someone new joins the effort and contributes.

[BrianEARTH]

@solardiz Thx for your answer ... I will keep my old file on my hdd if one day someone find a solution !!!