=================================================================== RCS file: /cvs/palm/Palm-Keyring/lib/Palm/Keyring.pm,v retrieving revision 1.12 retrieving revision 1.16 diff -u -r1.12 -r1.16 --- palm/Palm-Keyring/lib/Palm/Keyring.pm 2007/01/28 00:18:46 1.12 +++ palm/Palm-Keyring/lib/Palm/Keyring.pm 2007/01/30 04:59:55 1.16 @@ -1,458 +1,489 @@ -# Palm::Keyring.pm +package Palm::Keyring; + +# $RedRiver: Keyring.pm,v 1.15 2007/01/29 02:49:41 andrew Exp $ # -# Perl class for dealing with Keyring for Palm OS databases. +# Perl class for dealing with Keyring for Palm OS databases. # -# Copyright (C) 2004, Andrew Fresh -# You may distribute this file under the terms of the Artistic -# License, as specified in the README file distributed with the p5-Palm distribution. -# # This started as Memo.pm, I just made it work for Keyring. -# -# $RedRiver: Keyring.pm,v 1.11 2007/01/27 23:59:29 andrew Exp $ use strict; -package Palm::Keyring; -use Palm::Raw(); -use Palm::StdAppInfo(); -use vars qw( $VERSION @ISA ); +use warnings; +use Carp; +use base qw/ Palm::StdAppInfo /; + use Digest::MD5 qw(md5); use Crypt::DES; +use Readonly; -use constant ENCRYPT => 1; -use constant DECRYPT => 0; -use constant MD5_CBLOCK => 64; -my $kSaltSize = 4; +Readonly my $ENCRYPT => 1; +Readonly my $DECRYPT => 0; +Readonly my $MD5_CBLOCK => 64; +Readonly my $kSalt_Size => 4; +Readonly my $EMPTY => q{}; +Readonly my $SPACE => q{ }; +Readonly my $NULL => chr 0; - # One liner, to allow MakeMaker to work. -$VERSION = do { my @r = (q$Revision: 1.12 $ =~ /\d+/g); sprintf "%d."."%02d" x $#r, @r }; +our $VERSION = 0.91; -@ISA = qw( Palm::StdAppInfo Palm::Raw ); +sub new { + my $classname = shift; + my $pass = shift; -=head1 NAME + # Create a generic PDB. No need to rebless it, though. + my $self = $classname->SUPER::new(@_); -Palm::Keyring - Handler for Palm Keyring databases. + $self->{'name'} = 'Keys-Gtkr'; # Default + $self->{'creator'} = 'Gtkr'; + $self->{'type'} = 'Gkyr'; -=head1 SYNOPSIS + # The PDB is not a resource database by + # default, but it's worth emphasizing, + # since MemoDB is explicitly not a PRC. + $self->{'attributes'}{'resource'} = 0; - use Palm::PDB; - use Palm::Keyring; - my $pdb = new Palm::PDB; - $pdb->Load($file); - foreach my $record (@{ $pdb->{'records'} }) { - print "$record->{'plaintext'}->{'name'}\n"; - } - $pdb->Decrypt($password); - # do something with the decrypted parts + # Initialize the AppInfo block + $self->{'appinfo'} = {}; -=head1 DESCRIPTION + # Add the standard AppInfo block stuff + Palm::StdAppInfo::seed_StdAppInfo( $self->{'appinfo'} ); -The Keyring PDB handler is a helper class for the Palm::PDB package. It -parses Keyring for Palm OS databases. See -L. + # Set the version + $self->{'version'} = 4; -It has the standard Palm::PDB methods with 2 additional public methods. -Decrypt and Encrypt. + if ( defined $pass ) { + $self->Password($pass); + } -It currently supports the v4 Keyring databases. The v5 databases from the pre-release keyring-2.0 are not supported. + return $self; +} -=cut +sub import { + Palm::PDB::RegisterPDBHandlers( __PACKAGE__, [ 'Gtkr', 'Gkyr' ], ); + return 1; +} -=head2 new +sub ParseRecord { + my $self = shift; - $pdb = new Palm::Keyring([$password]); + my $rec = $self->SUPER::ParseRecord(@_); -Create a new PDB, initialized with the various Palm::Keyring fields -and an empty record list. + # skip the 0 record that holds the password + return $rec if ! exists $self->{'records'}; -Use this method if you're creating a Keyring PDB from scratch otherwise you -can just use Palm::PDB::new(). + # skip records with no data (There shouldn't be any) + return $rec if ! exists $rec->{'data'}; -=cut + my ( $name, $encrypted ) = split /$NULL/xm, $rec->{'data'}, 2; -sub new -{ - my $classname = shift; - my $pass = shift; + return $rec if ! $encrypted; + $rec->{'data'} = $name; + $rec->{'encrypted'} = $encrypted; - # Create a generic PDB. No need to rebless it, though. - my $self = $classname->SUPER::new(@_); + return $rec; +} - $self->{name} = "Keys-Gtkr"; # Default - $self->{creator} = "Gtkr"; - $self->{type} = "Gkyr"; - # The PDB is not a resource database by - # default, but it's worth emphasizing, - # since MemoDB is explicitly not a PRC. - $self->{attributes}{resource} = 0; +sub PackRecord { + my $self = shift; + my $rec = shift; - # Initialize the AppInfo block - $self->{appinfo} = {}; + my $rec0_id = $self->{'records'}->[0]->{'id'}; - # Add the standard AppInfo block stuff - &Palm::StdAppInfo::seed_StdAppInfo($self->{appinfo}); + if ($rec->{'encrypted'} && ! $rec->{'id'} == $rec0_id) { + $rec->{'data'} = join $NULL, $rec->{'data'}, $rec->{'encrypted'}; + delete $rec->{'encrypted'}; + } - # Set the version - $self->{version} = 4; + return $self->SUPER::PackRecord($rec, @_); +} - # Give the PDB the first record that will hold the encrypted password - $self->{records} = [ $self->new_Record ]; +sub Encrypt { + my $self = shift; + my $rec = shift; + my $data = shift; + my $pass = shift || $self->{'password'}; - if (defined $pass) { - $self->Encrypt($pass); - } + if ( ! $pass) { + croak("'password' not set!\n"); + } - return $self; -} + if ( ! $rec) { + croak("Needed parameter 'record' not passed!\n"); + } -sub import -{ - &Palm::PDB::RegisterPDBHandlers(__PACKAGE__, - [ "Gtkr", "Gkyr" ], - ); -} + if ( ! $data) { + croak("Needed parameter 'data' not passed!\n"); + } -=pod + if ( ! $self->Password($pass)) { + croak("Incorrect Password!\n"); + } -=head2 Load + $self->{'digest'} ||= _calc_keys( $pass ); - $pdb->Load($filename[, $password]); + $data->{'account'} ||= $EMPTY; + $data->{'password'} ||= $EMPTY; + $data->{'notes'} ||= $EMPTY; -Overrides the standard Palm::Raw Load() to add -$record->{'plaintext'}->{'name'} and -$record->{'encrypted'} fields. -$record->{'plaintext'}->{'name'} holds the name of the record, -$record->{'encrypted'} is the encrypted information in the PDB. + my $plaintext = join $NULL, + $data->{'account'}, $data->{'password'}, $data->{'notes'}; -It also takes an additional optional parameter, which is the password to use to -decrypt the database. + my $encrypted = _crypt3des( $plaintext, $self->{'digest'}, $ENCRYPT ); -See Decrypt() for the additional fields that are available after decryption. + return if ! $encrypted; -=cut + $rec->{'data'} ||= $data->{'name'}; + $rec->{'encrypted'} = $encrypted; + return 1; +} -sub Load -{ - my $self = shift; - my $filename = shift; - my $password = shift; +sub Decrypt { + my $self = shift; + my $rec = shift; + my $pass = shift || $self->{'password'}; - $self->{'appinfo'} = {}; - $self->{'records'} = []; - $self->SUPER::Load($filename); + if ( ! $pass) { + croak("'password' not set!\n"); + } - foreach my $record (@{ $self->{records} }) { - next unless exists $record->{data}; - my ($name, $encrypted) = split /\000/, $record->{data}, 2; - next unless $encrypted; - $record->{plaintext}->{name} = $name; - $record->{encrypted} = $encrypted; - } + if ( ! $rec) { + carp("Needed parameter 'record' not passed!\n"); + return; + } - return $self->Decrypt($password) if defined $password; + if ( ! $self->Password($pass)) { + croak("Invalid Password!\n"); + } - 1; -} + if ( ! $rec->{'encrypted'} ) { + croak("No encrypted content!"); + } -=pod + $self->{'digest'} ||= _calc_keys( $pass ); -=head2 Write + my $decrypted = + _crypt3des( $rec->{'encrypted'}, $self->{'digest'}, $DECRYPT ); + my ( $account, $password, $notes, $extra ) = split /$NULL/xm, + $decrypted, 4; - $pdb->Write($filename[, $password]); + return { + account => $account, + password => $password, + notes => $notes, + }; +} -Just like the Palm::Raw::Write() but encrypts everything before saving. +sub Password { + my $self = shift; + my $pass = shift || $self->{'password'}; + my $new_pass = shift; -Also takes an optional password to encrypt with a new password, not needed -unless you are changing the password. + if (! exists $self->{'records'}) { + # Give the PDB the first record that will hold the encrypted password + $self->{'records'} = [ $self->new_Record ]; -=cut + return $self->_password_update($pass); + } -sub Write -{ - my $self = shift; - my $filename = shift; - my $password = shift; + if ($new_pass) { + my @accts = (); + foreach my $i (0..$#{ $self->{'records'} }) { + if ($i == 0) { + push @accts, undef; + next; + } + my $acct = $self->Decrypt($self->{'records'}->[$i], $pass); + if ( ! $acct ) { + croak("Couldn't decrypt $self->{'records'}->[$i]->{'data'}"); + } + push @accts, $acct; + } - $self->Encrypt($password) || return undef; - return $self->SUPER::Write($filename); + if ( ! $self->_password_update($new_pass)) { + croak("Couldn't set new password!"); + } + $pass = $new_pass; + + foreach my $i (0..$#accts) { + next if $i == 0; + $self->Encrypt($self->{'records'}->[$i], $accts[$i], $pass); + } + } + + return $self->_password_verify($pass); } -=pod +sub _calc_keys { + my $pass = shift; + if (! defined $pass) { croak('No password defined!'); }; -=head2 Encrypt + my $digest = md5($pass); - $pdb->Encrypt([$password]); + my ( $key1, $key2 ) = unpack 'a8a8', $digest; -Encrypts the PDB, either with the password used to decrypt or create it, or -optionally with a password that is passed. + #-------------------------------------------------- + # print "key1: $key1: ", length $key1, "\n"; + # print "key2: $key2: ", length $key2, "\n"; + #-------------------------------------------------- -See Decrypt() for an what plaintext fields are available to be encrypted. + $digest = unpack 'H*', $key1 . $key2 . $key1; -=cut + #-------------------------------------------------- + # print "Digest: ", $digest, "\n"; + # print length $digest, "\n"; + #-------------------------------------------------- -sub Encrypt -{ - my $self = shift; - my $pass = shift; + return $digest; +} - if ($pass) { - unless (exists $self->{'records'}->[0]->{'data'} && - $self->_keyring_verify($pass) ) { - # This would encrypt with a new password. - # First decrypting everything with the old password of course. - $self->_keyring_update($pass) || return undef; - $self->_keyring_verify($pass) || return undef; - } - } +sub _password_verify { + my $self = shift; + my $pass = shift; - $self->{digest} ||= _calc_keys($self->{password}); + if (! $pass) { croak('No password specified!'); }; - foreach my $record (@{ $self->{records} }) { - next unless defined $record->{plaintext}; + if (defined $self->{'password'} && $pass eq $self->{'password'}) { + # already verified this password + return 1; + } - my $name = defined $record->{plaintext}->{name} ? - $record->{plaintext}->{name} : ''; - my $account = defined $record->{plaintext}->{account} ? - $record->{plaintext}->{account} : ''; - my $password = defined $record->{plaintext}->{password} ? - $record->{plaintext}->{password} : ''; - my $description = defined $record->{plaintext}->{description} ? - $record->{plaintext}->{description} : ''; - my $extra = ''; + # AFAIK the thing we use to test the password is + # always in the first entry + my $data = $self->{'records'}->[0]->{'data'}; - my $plaintext = join("\000", $account, $password, $description, $extra); + #die "No encrypted password in file!" unless defined $data; + if ( ! defined $data) { return; }; - my $encrypted = _crypt3des($plaintext, $self->{digest}, ENCRYPT); + $data =~ s/$NULL$//xm; - $record->{data} = join("\000", $name, $encrypted); - } + my $salt = substr $data, 0, $kSalt_Size; - 1; + my $msg = $salt . $pass; + + $msg .= "\0" x ( $MD5_CBLOCK - length $msg ); + + my $digest = md5($msg); + + if ( $data eq $salt . $digest ) { + +# May as well generate the keys we need now, since we know the password is right + $self->{'digest'} = _calc_keys($pass); + if ( $self->{'digest'} ) { + $self->{'password'} = $pass; + return 1; + } + } + return; } -=head2 Decrypt +sub _password_update { - $pdb->Decrypt([$password]); + # It is very important to Encrypt after calling this + # (Although it is generally only called by Encrypt) + # because otherwise the data will be out of sync with the + # password, and that would suck! + my $self = shift; + my $pass = shift; -Decrypts the PDB and fills out the rest of the fields available in -$record->{'plaintext'}. + if (! defined $pass) { croak('No password specified!'); }; -The plaintext should now be this, before encryption or after decryption: + my $salt; + for ( 1 .. $kSalt_Size ) { + $salt .= chr int rand 255; + } - $record->{'plaintext'} = { - name => $name, - account => $account, - password => $account_password, - description => $description, - }; + my $msg = $salt . $pass; -=cut + $msg .= "\0" x ( $MD5_CBLOCK - length $msg ); -sub Decrypt -{ - my $self = shift; - my $pass = shift; + my $digest = md5($msg); - if ($pass) { - $self->_keyring_verify($pass) || return undef; - } + my $data = $salt . $digest; # . "\0"; - $self->{digest} ||= _calc_keys($self->{password}); + # AFAIK the thing we use to test the password is + # always in the first entry + $self->{'records'}->[0]->{'data'} = $data; - foreach my $record (@{ $self->{records} }) { - next unless defined $record->{data}; + $self->{'password'} = $pass; + $self->{'digest'} = _calc_keys( $self->{'password'} ); - my ($name, $encrypted) = split /\000/, $record->{data}, 2; - next unless $encrypted; + return 1; +} - $record->{plaintext}->{name} = $name; +sub _crypt3des { + my ( $plaintext, $passphrase, $flag ) = @_; - my $decrypted = _crypt3des($encrypted, $self->{digest}, DECRYPT); - my ($account, $password, $description, $extra) - = split /\000/, $decrypted, 4; + $passphrase .= $SPACE x ( 16 * 3 ); + my $cyphertext = $EMPTY; - $record->{plaintext}->{account} = defined $account ? - $account : ''; - $record->{plaintext}->{password} = defined $password ? - $password : ''; - $record->{plaintext}->{description} = defined $description ? - $description : ''; + my $size = length $plaintext; - #print "Name: '$name'\n"; - #print "Encrypted: '$encrypted' - Length: " . length($encrypted) . "\n"; - #print " Hex: '" . unpack("H*", $encrypted) . "'\n"; - #print " Binary:'" . unpack("b*", $encrypted) . "'\n"; - #print "Decrypted: '$decrypted' - Length: " . length($decrypted) . "\n"; - #print " Hex: '" . unpack("H*", $decrypted) . "'\n"; - #print " Binary:'" . unpack("b*", $decrypted) . "'\n"; - #print "\n"; - #print "Extra: $extra\n"; - #exit; - #-------------------------------------------------- - # print "Account: $account\n"; - # print "Password: $password\n"; - # print "Description: $description\n"; - #-------------------------------------------------- + #print "STRING: '$plaintext' - Length: " . (length $plaintext) . "\n"; - } + my @C; + for ( 0 .. 2 ) { + $C[$_] = + new Crypt::DES( pack 'H*', ( substr $passphrase, 16 * $_, 16 )); + } - 1; -} + for ( 0 .. ( ($size) / 8 ) ) { + my $pt = substr $plaintext, $_ * 8, 8; -sub _calc_keys -{ - my $pass = shift; - die "No password defined!" unless defined $pass; + #print "PT: '$pt' - Length: " . length($pt) . "\n"; + if (! length $pt) { next; }; + if ( (length $pt) < 8 ) { + if ($flag == $DECRYPT) { croak('record not 8 byte padded'); }; + my $len = 8 - (length $pt); - my $digest = md5($pass); + #print "LENGTH: $len\n"; + #print "Binary: '" . unpack("b*", $pt) . "'\n"; + $pt .= ($NULL x $len); - my ($key1, $key2) = unpack('a8a8', $digest); - #-------------------------------------------------- - # print "key1: $key1: ", length $key1, "\n"; - # print "key2: $key2: ", length $key2, "\n"; - #-------------------------------------------------- + #print "PT: '$pt' - Length: " . length($pt) . "\n"; + #print "Binary: '" . unpack("b*", $pt) . "'\n"; + } + if ( $flag == $ENCRYPT ) { + $pt = $C[0]->encrypt($pt); + $pt = $C[1]->decrypt($pt); + $pt = $C[2]->encrypt($pt); + } + else { + $pt = $C[0]->decrypt($pt); + $pt = $C[1]->encrypt($pt); + $pt = $C[2]->decrypt($pt); + } - $digest = unpack('H*', $key1 . $key2 . $key1); - #-------------------------------------------------- - # print "Digest: ", $digest, "\n"; - # print length $digest, "\n"; - #-------------------------------------------------- + #print "PT: '$pt' - Length: " . length($pt) . "\n"; + $cyphertext .= $pt; + } - return $digest; + $cyphertext =~ s/$NULL+$//xm; + + #print "CT: '$cyphertext' - Length: " . length($cyphertext) . "\n"; + + return $cyphertext; } -sub _keyring_verify -{ - my $self = shift; - my $pass = shift; +1; +__END__ - die "No password specified!" unless $pass; +=head1 NAME - # AFAIK the thing we use to test the password is - # always in the first entry - my $data = $self->{records}->[0]->{data}; - #die "No encrypted password in file!" unless defined $data; - return undef unless defined $data; +Palm::Keyring - Handler for Palm Keyring databases. - $data =~ s/\0$//; +=head1 DESCRIPTION - my $salt = substr($data, 0, $kSaltSize); +The Keyring PDB handler is a helper class for the Palm::PDB package. It +parses Keyring for Palm OS databases. See +L. - my $msg = $salt . $pass; +It has the standard Palm::PDB methods with 2 additional public methods. +Decrypt and Encrypt. - $msg .= "\0" x (MD5_CBLOCK - length($msg)); +It currently supports the v4 Keyring databases. The v5 databases from +the pre-release keyring-2.0 are not supported. - my $digest = md5($msg); +This module doesn't store the decrypted content. It only keeps it until it +returns it to you or encrypts it. - if ($data eq $salt . $digest) { - # May as well generate the keys we need now, since we know the password is right - $self->{digest} = _calc_keys($pass); - if ($self->{digest}) { - $self->{password} = $pass; - return 1; - } else { - return undef; - } - } else { - return undef; - } -} +=head1 SYNOPSIS -sub _keyring_update -{ - # It is very important to Encrypt after calling this - # (Although it is generally only called by Encrypt) - # because otherwise the data will be out of sync with the - # password, and that would suck! - my $self = shift; - my $pass = shift; + use Palm::PDB; + use Palm::Keyring; + my $pdb = new Palm::PDB; + $pdb->Load($file); + foreach my $rec (@{ $pdb->{'records'} }) { + print "$rec->{'plaintext'}->{'name'}\n"; + } + $pdb->Decrypt($password); + # do something with the decrypted parts - die "No password specified!" unless $pass; +=head1 SUBROUTINES/METHODS - # if the database already has a password in it - if ($self->{records}->[0]->{data}) { - # Make sure everything is decrypted before we update the keyring - $self->Decrypt() || return undef; - } +=head2 new - my $salt; - for (1..$kSaltSize) { - $salt .= chr(int(rand(255))); - } + $pdb = new Palm::Keyring([$password]); - my $msg = $salt . $pass; +Create a new PDB, initialized with the various Palm::Keyring fields +and an empty record list. - $msg .= "\0" x (MD5_CBLOCK - length($msg)); +Use this method if you're creating a Keyring PDB from scratch otherwise you +can just use Palm::PDB::new() before calling Load(). - my $digest = md5($msg); +=head2 Encrypt - my $data = $salt . $digest;# . "\0"; + $pdb->Encrypt($rec, $acct, [$password]); - # AFAIK the thing we use to test the password is - # always in the first entry - $self->{records}->[0]->{data} = $data; +Encrypts an account into a record, either with the password previously +used, or with a password that is passed. - $self->{password} = $pass; - $self->{digest} = _calc_keys($self->{password}); +$rec is a record from $pdb->{'records'} or a newly generated record. +$acct is a hashref in the format below. - return 1; -} + my $acct = { + account => $account, + password => $password, + notes => $notes, + }; -sub _crypt3des { - my ( $plaintext, $passphrase, $flag ) = @_; - my $NULL = chr(0); +=head2 Decrypt - $passphrase .= ' ' x (16*3); - my $cyphertext = ""; + my $acct = $pdb->Decrypt($rec[, $password]); - my $size = length ( $plaintext ); - #print "STRING: '$plaintext' - Length: " . length($plaintext) . "\n"; +Decrypts the record and returns a hashref for the account as described +under Encrypt(); - my @C; - for ( 0..2 ) { - $C[$_] = new Crypt::DES( pack( "H*", substr($passphrase, 16*$_, 16 ))); - } + foreach (0..$#{ $pdb->{'records'}) { + next if $_ == 0; + my $rec = $pdb->{'records'}->[$_]; + my $acct = $pdb->Decrypt($rec[, $password]); + # do something with $acct + } - for ( 0 .. (($size)/8)) { - my $pt = substr( $plaintext, $_*8, 8 ); - #print "PT: '$pt' - Length: " . length($pt) . "\n"; - next unless length($pt); - if (length($pt) < 8) { - die "record not 8 byte padded" if $flag == DECRYPT; - my $len = 8 - length($pt); - #print "LENGTH: $len\n"; - #print "Binary: '" . unpack("b*", $pt) . "'\n"; - $pt .= ($NULL x $len); - #print "PT: '$pt' - Length: " . length($pt) . "\n"; - #print "Binary: '" . unpack("b*", $pt) . "'\n"; - } - if ($flag == ENCRYPT) { - $pt = $C[0]->encrypt( $pt ); - $pt = $C[1]->decrypt( $pt ); - $pt = $C[2]->encrypt( $pt ); - } else { - $pt = $C[0]->decrypt( $pt ); - $pt = $C[1]->encrypt( $pt ); - $pt = $C[2]->decrypt( $pt ); - } - #print "PT: '$pt' - Length: " . length($pt) . "\n"; - $cyphertext .= $pt; - } +=head2 Password - $cyphertext =~ s/$NULL+$//; - #print "CT: '$cyphertext' - Length: " . length($cyphertext) . "\n"; + $pdb->Password([$password[, $new_password]]); - return $cyphertext; -} +Either sets the password to be used to crypt, or if you pass $new_password, +changes the password on the database. -1; -__END__ +If you have created a new $pdb, and you didn't set a password when you +called new(), you only need to pass one password and it will set that as +the password. +If nothing is passed, and there has been a password used before, +it just verifies that the password was correct. + +=head1 DEPENDENCIES + +Palm::StdAppInfo + +Digest::MD5 + +Crypt::DES + +Readonly + +=head1 BUGS AND LIMITATIONS + +Once this module is uploaded, you can +Please report any bugs or feature requests to +C, or through the web interface at +L. I will be notified, and then you'll automatically be +notified of progress on your bug as I make changes. + =head1 AUTHOR Andrew Fresh Eandrew@mad-techies.orgE +=head1 LICENSE AND COPYRIGHT + +Copyright 2004, 2005, 2006, 2007 Andrew Fresh, All Rights Reserved. + +This program is free software; you can redistribute it and/or +modify it under the same terms as Perl itself. + =head1 SEE ALSO Palm::PDB(3) @@ -461,5 +492,3 @@ The Keyring for Palm OS website: L - -=cut