Comparison of the Agile and OS X Keychains

Many years ago, 1Password used the OS X keychain format to store data. This served us and our users very well for a while because the format was built into OS X and offered good security. But over the years, our customers told us that they want more flexibility, even stronger security, and better ways to secure more kinds of sensitive data with 1Password. We listened, and we researched, and after more than a year of work deep in our labs, the Agile Keychain file was born.

Feature Comparison

From a feature standpoint, the Agile Keychain allows us to answer the many requests of our users. Armed with the Agile Keychain, only 1Password can:

Technical Comparison

Here is a quick comparison of the OS X keychain format and Agile Keychain from a more technical perspective:

OS X keychain format Agile Keychain
File-Level Sync ✘ not practical ✔ robust, easy, instant
Performance ✘ degrades as size increases ✔ fast even at GB sizes
Auto-Lock ✘ based on keychain use ✔ based on computer use
Data Encryption ✘ Triple DES (outmoded) ✔ AES CBC with PBDKF2
Automatic Sync between Computers ✘ not supported ✔ Dropbox and other file-based sync solutions
Automatic Sync with Mobile Devices ✘ not supported ✔ Dropbox
Attachments ✘ not supported ✔ attach files to any item

File-Level Syncing

File-level syncing is not practical with the OS X keychain format because everything is stored in a single file. Each modification causes the entire file to be recreated and then synced. This hurts performance and increases the chance of conflicts.

Performance

The OS X keychain format slows significantly as its size increases because it creates an entire copy of the file and then replaces the original.

Auto-Lock

The OS X keychain’s auto-lock function is based on keychain usage. The amount of time between using the keychain is calculated to determine if the keychain is locked. User activity such as typing or mouse movement is irrelevant. This forces you to specify a much longer automatic lock time than necessary for normal usage.

Data Encryption

The OS X keychain uses Triple DES as its encryption algorithm which is quite secure, but it is growing older and has been superseded by newer encryption algorithms with longer key lengths. The US government has deprecated the use of Triple DES and has set AES as its new standard.

Syncing

The OS X keychain has no support for any kind of syncing. The Agile Keychain can be synced automatically through Dropbox or other services.

Geeky Details

For details on design and security of the Agile Keychain, please see the Agile Keychain Design document.