Comparison of the Agile and OS X Keychains
Many years ago, 1Password used the OS X keychain format to store data. This served us and our users very well for a while because the format was built into OS X and offered good security. But over the years, our customers told us that they want more flexibility, even stronger security, and better ways to secure more kinds of sensitive data with 1Password. We listened, and we researched, and after more than a year of work deep in our labs, the Agile Keychain file was born.
Feature Comparison
From a feature standpoint, the Agile Keychain allows us to answer the many requests of our users. Armed with the Agile Keychain, only 1Password can:
- Store and provide easy access to more than one account for any website.
- Correctly handle financial websites which often disable storing passwords with browsers’ AutoFill features.
- Integrate with multiple browsers including Safari, Chrome, and Firefox.
- Eliminate the need to manually transfer your data between browsers.
- Support multiple “Identities” such as one for personal and another for business use. You can even create fake identities for websites you do not trust.
- Securely store credit card information and fill it with a click.
- Import information from a variety of other apps, including some from Windows.
- Integrate a Strong Password Generator directly into the browser for quick and painless generation of incredibly strong passwords.
- Sync your information to an iPhone, iPad, iPod touch, Android, or Windows Phone 7 device.
Technical Comparison
Here is a quick comparison of the OS X keychain format and Agile Keychain from a more technical perspective:
OS X keychain format | Agile Keychain | |
---|---|---|
File-Level Sync | ✘ not practical | ✔ robust, easy, instant |
Performance | ✘ degrades as size increases | ✔ fast even at GB sizes |
Auto-Lock | ✘ based on keychain use | ✔ based on computer use |
Data Encryption | ✘ Triple DES (outmoded) | ✔ AES CBC with PBDKF2 |
Automatic Sync between Computers | ✘ not supported | ✔ Dropbox and other file-based sync solutions |
Automatic Sync with Mobile Devices | ✘ not supported | ✔ Dropbox |
Attachments | ✘ not supported | ✔ attach files to any item |
File-Level Syncing
File-level syncing is not practical with the OS X keychain format because everything is stored in a single file. Each modification causes the entire file to be recreated and then synced. This hurts performance and increases the chance of conflicts.
Performance
The OS X keychain format slows significantly as its size increases because it creates an entire copy of the file and then replaces the original.
Auto-Lock
The OS X keychain’s auto-lock function is based on keychain usage. The amount of time between using the keychain is calculated to determine if the keychain is locked. User activity such as typing or mouse movement is irrelevant. This forces you to specify a much longer automatic lock time than necessary for normal usage.
Data Encryption
The OS X keychain uses Triple DES as its encryption algorithm which is quite secure, but it is growing older and has been superseded by newer encryption algorithms with longer key lengths. The US government has deprecated the use of Triple DES and has set AES as its new standard.
Syncing
The OS X keychain has no support for any kind of syncing. The Agile Keychain can be synced automatically through Dropbox or other services.
Geeky Details
For details on design and security of the Agile Keychain, please see the Agile Keychain Design document.