version 1.2, 2006/01/31 23:03:39 |
version 1.28, 2007/02/18 05:50:25 |
|
|
# Palm::Keyring.pm |
package Palm::Keyring; |
|
# $RedRiver: Keyring.pm,v 1.27 2007/02/10 16:21:28 andrew Exp $ |
|
######################################################################## |
|
# Keyring.pm *** Perl class for Keyring for Palm OS databases. |
# |
# |
# Perl class for dealing with Keyring for Palm OS databases. |
|
# |
|
# Copyright (C) 2004, Andrew Fresh |
|
# You may distribute this file under the terms of the Artistic |
|
# License, as specified in the README file distributed with the p5-Palm distribution. |
|
# |
|
# This started as Memo.pm, I just made it work for Keyring. |
# This started as Memo.pm, I just made it work for Keyring. |
# |
# |
# $Id$ |
# 2006.01.26 #*#*# andrew fresh <andrew@cpan.org> |
# $RedRiver: Keyring.pm,v 1.1 2006/01/26 20:54:19 andrew Exp $ |
######################################################################## |
|
# Copyright (C) 2006, 2007 by Andrew Fresh |
|
# |
|
# This program is free software; you can redistribute it and/or modify |
|
# it under the same terms as Perl itself. |
|
######################################################################## |
use strict; |
use strict; |
package Palm::Keyring; |
use warnings; |
use Palm::Raw(); |
|
use Palm::StdAppInfo(); |
|
use vars qw( $VERSION @ISA ); |
|
|
|
|
use Carp; |
|
|
|
use base qw/ Palm::StdAppInfo /; |
|
|
|
use Digest::HMAC_SHA1 qw(hmac_sha1); |
|
use Digest::SHA1 qw(sha1); |
|
use Crypt::CBC; |
|
|
use Digest::MD5 qw(md5); |
use Digest::MD5 qw(md5); |
use Crypt::DES; |
use Crypt::DES; |
|
|
use constant ENCRYPT => 1; |
my $ENCRYPT = 1; |
use constant DECRYPT => 0; |
my $DECRYPT = 0; |
use constant MD5_CBLOCK => 64; |
my $MD5_CBLOCK = 64; |
my $kSaltSize = 4; |
my $kSalt_Size = 4; |
|
my $EMPTY = q{}; |
|
my $SPACE = q{ }; |
|
my $NULL = chr 0; |
|
|
|
my @CRYPTS = ( |
|
{ # None |
|
name => 'None', |
|
keylen => 8, |
|
blocksize => 1, |
|
}, |
|
{ # DES-EDE3 |
|
name => 'DES_EDE3', |
|
keylen => 24, |
|
blocksize => 8, |
|
DES_odd_parity => 1, |
|
}, |
|
{ # AES128 |
|
name => 'Rijndael', |
|
keylen => 16, |
|
blocksize => 16, |
|
}, |
|
{ # AES256 |
|
name => 'Rijndael', |
|
keylen => 32, |
|
blocksize => 16, |
|
}, |
|
); |
|
|
# One liner, to allow MakeMaker to work. |
|
$VERSION = do { my @r = (q$Revision$ =~ /\d+/g); sprintf "%d."."%02d" x $#r, @r }; |
|
|
|
@ISA = qw( Palm::StdAppInfo Palm::Raw ); |
our $VERSION = 0.95; |
|
|
=head1 NAME |
sub new |
|
{ |
|
my $classname = shift; |
|
my $options = {}; |
|
|
Palm::Keyring - Handler for Palm Keyring databases. |
# hashref arguments |
|
if (ref $_[0] eq 'HASH') { |
|
$options = shift; |
|
} |
|
|
=head1 SYNOPSIS |
# CGI style arguments |
|
elsif ($_[0] =~ /^-[a-zA-Z_]{1,20}$/) { |
|
my %tmp = @_; |
|
while ( my($key,$value) = each %tmp) { |
|
$key =~ s/^-//; |
|
$options->{lc $key} = $value; |
|
} |
|
} |
|
|
use Palm::Keyring; |
else { |
$pdb->Decrypt('mypassword'); |
$options->{password} = shift; |
|
$options->{version} = shift; |
|
} |
|
|
=head1 DESCRIPTION |
# Create a generic PDB. No need to rebless it, though. |
|
my $self = $classname->SUPER::new(); |
|
|
The Keyring PDB handler is a helper class for the Palm::PDB package. It |
$self->{name} = 'Keys-Gtkr'; # Default |
parses Keyring databases. See |
$self->{creator} = 'Gtkr'; |
L<http://gnukeyring.sourceforge.net/>. |
$self->{type} = 'Gkyr'; |
|
|
It is just the standard Palm::Raw with 2 additional public methods. Decrypt and Encrypt. |
# The PDB is not a resource database by |
|
# default, but it's worth emphasizing, |
|
# since MemoDB is explicitly not a PRC. |
|
$self->{attributes}{resource} = 0; |
|
|
=cut |
# Set the version |
=head2 new |
$self->{version} = $options->{version} || 4; |
|
|
$pdb = new Palm::Keyring ('password'); |
# Set options |
|
$self->{options} = $options; |
|
|
Create a new PDB, initialized with the various Palm::Keyring fields |
if ( defined $options->{password} ) { |
and an empty record list. |
$self->Password($options->{password}); |
|
} |
|
|
Use this method if you're creating a Keyring PDB from scratch. |
return $self; |
|
} |
|
|
=cut |
sub import |
#' |
|
sub new |
|
{ |
{ |
my $classname = shift; |
Palm::PDB::RegisterPDBHandlers( __PACKAGE__, [ 'Gtkr', 'Gkyr' ], ); |
my $pass = shift; |
return 1; |
|
} |
|
|
my $self = $classname->SUPER::new(@_); |
# PackRecord |
# Create a generic PDB. No need to rebless it, |
|
# though. |
|
|
|
$self->{name} = "Keys-Gtkr"; # Default |
sub ParseRecord |
$self->{creator} = "Gtkr"; |
{ |
$self->{type} = "Gkyr"; |
my $self = shift; |
$self->{attributes}{resource} = 0; |
|
# The PDB is not a resource database by |
|
# default, but it's worth emphasizing, |
|
# since MemoDB is explicitly not a PRC. |
|
|
|
# Initialize the AppInfo block |
my $rec = $self->SUPER::ParseRecord(@_); |
$self->{appinfo} = {}; |
return $rec if ! exists $rec->{data}; |
|
|
# Add the standard AppInfo block stuff |
if ($self->{version} == 4) { |
&Palm::StdAppInfo::seed_StdAppInfo($self->{appinfo}); |
# skip the first record because it contains the password. |
|
return $rec if ! exists $self->{records}; |
|
|
# Set the version |
my ( $name, $encrypted ) = split /$NULL/xm, $rec->{data}, 2; |
$self->{version} = 4; |
|
|
|
# Give the PDB the first record that will hold the encrypted password |
return $rec if ! $encrypted; |
$self->{records} = [ |
$rec->{name} = $name; |
{ |
$rec->{encrypted} = $encrypted; |
'category' => 0, |
delete $rec->{data}; |
'attributes' => { |
|
'private' => 1, |
|
'Secret' => 1, |
|
'Dirty' => 1, |
|
'dirty' => 1 |
|
}, |
|
}, |
|
]; |
|
|
|
if ($pass) { |
} elsif ($self->{version} == 5) { |
$self->Encrypt($pass); |
my $blocksize = $self->{appinfo}->{blocksize}; |
} |
my ($field, $extra) = _parse_field($rec->{data}); |
|
my ($ivec, $encrypted) = unpack "A$blocksize A*", $extra; |
|
|
return $self; |
if ($self->{options}->{v4compatible}) { |
|
$rec->{name} = $field->{data}; |
|
} else { |
|
$rec->{name} = $field; |
|
} |
|
$rec->{ivec} = $ivec; |
|
$rec->{encrypted} = $encrypted; |
|
|
|
} else { |
|
# XXX Unsupported version! |
|
return; |
|
} |
|
|
|
return $rec; |
} |
} |
|
|
sub import |
sub _parse_keyring_date |
{ |
{ |
&Palm::PDB::RegisterPDBHandlers(__PACKAGE__, |
my $data = shift; |
[ "Gtkr", "Gkyr" ], |
|
); |
my $u = unpack 'n', $data; |
|
my $year = (($u & 0xFE00) >> 9) + 4; # since 1900 |
|
my $month = (($u & 0x01E0) >> 5) - 1; # 0-11 |
|
my $day = (($u & 0x001F) >> 0); # 1-31 |
|
|
|
return { |
|
year => $year, |
|
month => $month || 0, |
|
day => $day || 1, |
|
}; |
} |
} |
|
|
sub Encrypt |
# PackRecord |
|
|
|
sub PackRecord |
{ |
{ |
my $self = shift; |
my $self = shift; |
my $pass = shift; |
my $rec = shift; |
|
|
if ($pass) { |
if ($self->{version} == 4) { |
unless ($self->_keyring_verify($pass) ) { |
if ($rec->{encrypted}) { |
# This would encrypt with a new password. |
if (! defined $rec->{name}) { |
# First decrypting everything with the old password of course. |
$rec->{name} = $EMPTY; |
$self->_keyring_update($pass) || return undef; |
} |
$self->_keyring_verify($pass) || return undef; |
$rec->{data} = join $NULL, $rec->{name}, $rec->{encrypted}; |
} |
delete $rec->{name}; |
} |
delete $rec->{encrypted}; |
|
} |
|
} elsif ($self->{version} == 5) { |
|
# XXX do something |
|
} else { |
|
# XXX Unsupported version! |
|
return; |
|
} |
|
|
my $seen_enc_pass = 0; |
return $self->SUPER::PackRecord($rec, @_); |
foreach my $record (@{ $self->{records} }) { |
} |
unless ($seen_enc_pass) { |
|
$seen_enc_pass = 1; |
|
next; |
|
} |
|
|
|
next unless defined $record->{plaintext}; |
sub _pack_keyring_date |
|
{ |
|
my $d = shift; |
|
my $year = $d->{year}; |
|
my $month = $d->{month}; |
|
my $day = $d->{day}; |
|
|
my $name = defined $record->{plaintext}->{name} ? $record->{plaintext}->{name} : ''; |
$year -= 4; |
my $account = defined $record->{plaintext}->{account} ? $record->{plaintext}->{account} : ''; |
$month++; |
my $password = defined $record->{plaintext}->{password} ? $record->{plaintext}->{password} : ''; |
|
my $description = defined $record->{plaintext}->{description} ? $record->{plaintext}->{description} : ''; |
|
my $extra = ''; |
|
|
|
my $plaintext = join("\000", $account, $password, $description, $extra); |
return pack 'n', $day | ($month << 5) | ($year << 9); |
|
} |
|
|
my $encrypted = $self->_crypt3des($plaintext, ENCRYPT); |
# ParseAppInfoBlock |
|
|
$record->{data} = join("\000", $name, $encrypted); |
sub ParseAppInfoBlock |
} |
{ |
|
my $self = shift; |
|
my $data = shift; |
|
my $appinfo = {}; |
|
|
return 1; |
&Palm::StdAppInfo::parse_StdAppInfo($appinfo, $data); |
|
|
|
# int8/uint8 |
|
# - Signed or Unsigned Byte (8 bits). C types: char, unsigned char |
|
# int16/uint16 |
|
# - Signed or Unsigned Word (16 bits). C types: short, unsigned short |
|
# int32/uint32 |
|
# - Signed or Unsigned Doubleword (32 bits). C types: int, unsigned int |
|
# sz |
|
# - Zero-terminated C-style string |
|
|
|
if ($self->{version} == 4) { |
|
# Nothing extra for version 4 |
|
|
|
} elsif ($self->{version} == 5) { |
|
_parse_appinfo_v5($appinfo) || return; |
|
|
|
} else { |
|
# XXX Unknown version |
|
return; |
|
} |
|
|
|
return $appinfo; |
} |
} |
|
|
sub Decrypt |
sub _parse_appinfo_v5 |
{ |
{ |
my $self = shift; |
my $appinfo = shift; |
my $pass = shift; |
|
|
|
if ($pass) { |
if (! exists $appinfo->{other}) { |
$self->_keyring_verify($pass) || return undef; |
# XXX Corrupt appinfo? |
} |
return; |
|
} |
|
|
my $seen_enc_pass = 0; |
my $unpackstr |
foreach my $record (@{ $self->{records} }) { |
= ("C1" x 8) # 8 uint8s in an array for the salt |
unless ($seen_enc_pass) { |
. ("S1" x 2) # the iter (uint16) and the cipher (uint16) |
# need to skip the first record because it is the encrypted password |
. ("C1" x 8); # and finally 8 more uint8s for the hash |
$seen_enc_pass = 1; |
|
next; |
|
} |
|
|
|
next unless defined $record->{data}; |
my (@salt, $iter, $cipher, @hash); |
|
(@salt[0..7], $iter, $cipher, @hash[0..7]) |
|
= unpack $unpackstr, $appinfo->{other}; |
|
|
my ($name, $encrypted) = split /\000/, $record->{data}, 2; |
$appinfo->{salt} = sprintf "%02x" x 8, @salt; |
$record->{plaintext}->{name} = $name; |
$appinfo->{iter} = $iter; |
|
$appinfo->{cipher} = $cipher; |
|
$appinfo->{keylen} = $CRYPTS[$appinfo->{cipher}]{keylen}; |
|
$appinfo->{blocksize} = $CRYPTS[$appinfo->{cipher}]{blocksize}; |
|
$appinfo->{DES_odd_parity} = $CRYPTS[$appinfo->{cipher}]{DES_odd_parity}; |
|
$appinfo->{cipher_name} = $CRYPTS[$appinfo->{cipher}]{name}; |
|
$appinfo->{masterhash} = sprintf "%02x" x 8, @hash; |
|
delete $appinfo->{other}; |
|
|
my $decrypted = $self->_crypt3des($encrypted, DECRYPT); |
return $appinfo |
my ($account, $password, $description, $extra) |
} |
= split /\000/, $decrypted, 4; |
|
|
|
$record->{plaintext}->{account} = defined $account ? $account : ''; |
# PackAppInfoBlock |
$record->{plaintext}->{password} = defined $password ? $password : ''; |
|
$record->{plaintext}->{description} = defined $description ? $description : ''; |
|
|
|
print "Name: '$name'\n"; |
sub PackAppInfoBlock |
print "Encrypted: '$encrypted' - Length: " . length($encrypted) . "\n"; |
{ |
#print "Hex: '" . unpack("H*", $encrypted) . "'\n"; |
my $self = shift; |
#print "Binary: '" . unpack("b*", $encrypted) . "'\n"; |
my $retval; |
print "Decrypted: '$decrypted' - Length: " . length($decrypted) . "\n"; |
|
print "Hex: '" . unpack("H*", $decrypted) . "'\n"; |
|
print "Binary: '" . unpack("b*", $decrypted) . "'\n"; |
|
print "\n"; |
|
#print "Extra: $extra\n"; |
|
#-------------------------------------------------- |
|
# print "Account: $account\n"; |
|
# print "Password: $password\n"; |
|
# print "Description: $description\n"; |
|
#-------------------------------------------------- |
|
|
|
} |
if ($self->{version} == 4) { |
|
# Nothing to do for v4 |
|
|
return 1; |
} elsif ($self->{version} == 5) { |
|
croak("Unsupported version!"); |
|
#$self->{appinfo}{other} = <pack application-specific data>; |
|
} else { |
|
# XXX Unknown version |
|
return; |
|
} |
|
return &Palm::StdAppInfo::pack_StdAppInfo($self->{appinfo}); |
} |
} |
|
|
sub _calc_keys |
# Encrypt |
|
|
|
sub Encrypt |
{ |
{ |
my $self = shift; |
my $self = shift; |
|
my $rec = shift; |
|
my $data = shift; |
|
my $pass = shift || $self->{password}; |
|
|
my $pass = $self->{'password'}; |
if ( ! $pass && ! $self->{key}) { |
die "No password defined!" unless defined $pass; |
croak("password not set!\n"); |
|
} |
|
|
my $digest = md5($pass); |
if ( ! $rec) { |
|
croak("Needed parameter 'record' not passed!\n"); |
|
} |
|
|
my ($key1, $key2) = unpack('a8a8', $digest); |
if ( ! $data) { |
#-------------------------------------------------- |
croak("Needed parameter 'data' not passed!\n"); |
# print "key1: $key1: ", length $key1, "\n"; |
} |
# print "key2: $key2: ", length $key2, "\n"; |
|
#-------------------------------------------------- |
|
|
|
$digest = unpack('H*', $key1 . $key2 . $key1); |
if ( ! $self->Password($pass)) { |
#-------------------------------------------------- |
croak("Incorrect Password!\n"); |
# print "Digest: ", $digest, "\n"; |
} |
# print length $digest, "\n"; |
|
#-------------------------------------------------- |
|
|
|
$self->{digest} = $digest; |
if ($self->{version} == 4) { |
return $digest; |
$self->{digest} ||= _calc_keys( $pass ); |
|
my $acct = {}; |
|
if ($rec->{encrypted}) { |
|
$acct = $self->Decrypt($rec, $pass); |
|
} |
|
my $encrypted = _encrypt_v4($data, $self->{digest}, $acct); |
|
if ($encrypted) { |
|
$rec->{attributes}{Dirty} = 1; |
|
$rec->{attributes}{dirty} = 1; |
|
$rec->{name} ||= $data->{name}; |
|
$rec->{encrypted} = $encrypted; |
|
return 1; |
|
} |
|
} elsif ($self->{version} == 5) { |
|
croak("Unsupported version!"); |
|
return _encrypt_v5( |
|
$rec->{encrypted}, $rec->{ivec}, $self->{key}, |
|
$self->{appinfo}->{keylen}, $self->{appinfo}->{cipher_name}, |
|
); |
|
} else { |
|
# XXX Unsupported version! |
|
} |
|
return; |
} |
} |
|
|
sub _keyring_verify |
sub _encrypt_v4 |
{ |
{ |
my $self = shift; |
my $data = shift; |
my $pass = shift; |
my $digest = shift; |
|
my $acct = shift; |
|
|
die "No password specified!" unless defined $pass; |
$data->{account} ||= $EMPTY; |
$self->{password} = $pass; |
$data->{password} ||= $EMPTY; |
|
$data->{notes} ||= $EMPTY; |
|
|
# AFAIK the thing we use to test the password is |
my $changed = 0; |
# always in the first entry |
my $need_newdate = 0; |
my $data = $self->{records}->[0]->{data}; |
if (%{ $acct }) { |
#die "No encrypted password in file!" unless defined $data; |
foreach my $key (keys %{ $data }) { |
return undef unless defined $data; |
next if $key eq 'lastchange'; |
|
if ($data->{$key} ne $acct->{$key}) { |
|
$changed = 1; |
|
last; |
|
} |
|
} |
|
if ( exists $data->{lastchange} && exists $acct->{lastchange} && ( |
|
$data->{lastchange}->{day} != $acct->{lastchange}->{day} || |
|
$data->{lastchange}->{month} != $acct->{lastchange}->{month} || |
|
$data->{lastchange}->{year} != $acct->{lastchange}->{year} |
|
)) { |
|
$changed = 1; |
|
$need_newdate = 0; |
|
} else { |
|
$need_newdate = 1; |
|
} |
|
|
$data =~ s/\0$//; |
} else { |
|
$changed = 1; |
|
} |
|
|
my $salt = substr($data, 0, $kSaltSize); |
# no need to re-encrypt if it has not changed. |
|
return 1 if ! $changed; |
|
|
my $msg = $salt . $pass; |
my ($day, $month, $year); |
|
|
$msg .= "\0" x (MD5_CBLOCK - length($msg)); |
if ($data->{lastchange} && ! $need_newdate ) { |
|
$day = $data->{lastchange}->{day} || 1; |
|
$month = $data->{lastchange}->{month} || 0; |
|
$year = $data->{lastchange}->{year} || 0; |
|
|
my $digest = md5($msg); |
# XXX Need to actually validate the above information somehow |
|
if ($year >= 1900) { |
|
$year -= 1900; |
|
} |
|
} else { |
|
$need_newdate = 1; |
|
} |
|
|
if ($data eq $salt . $digest) { |
if ($need_newdate) { |
# May as well generate the keys we need now, since we know the password is right |
($day, $month, $year) = (localtime)[3,4,5]; |
if ($self->_calc_keys()) { |
} |
return 1; |
|
} else { |
my $packeddate = _pack_keyring_date( { |
return undef; |
year => $year, |
} |
month => $month, |
} else { |
day => $day, |
return undef; |
}); |
} |
|
|
my $plaintext = join $NULL, |
|
$data->{account}, $data->{password}, $data->{notes}, $packeddate; |
|
|
|
return _crypt3des( $plaintext, $digest, $ENCRYPT ); |
} |
} |
|
|
sub _keyring_update |
# Decrypt |
|
|
|
sub Decrypt |
{ |
{ |
# It is very important to Encrypt after calling this |
my $self = shift; |
# (Although it is generally only called by Encrypt) |
my $rec = shift; |
# because otherwise the data will be out of sync with the |
my $pass = shift || $self->{password}; |
# password, and that would suck! |
|
my $self = shift; |
|
my $pass = shift; |
|
|
|
die "No password specified!" unless defined $pass; |
if ( ! $pass && ! $self->{key}) { |
|
croak("password not set!\n"); |
|
} |
|
|
# if the database already has a password in it |
if ( ! $rec) { |
if ($self->{records}->[0]->{data}) { |
croak("Needed parameter 'record' not passed!\n"); |
# Make sure everything is decrypted before we update the keyring |
} |
$self->Decrypt() || return undef; |
|
} |
|
|
|
my $salt; |
if ( ! $self->Password($pass)) { |
for (1..$kSaltSize) { |
croak("Invalid Password!\n"); |
$salt .= chr(int(rand(255))); |
} |
} |
|
|
|
my $msg = $salt . $pass; |
if ( ! $rec->{encrypted} ) { |
|
croak("No encrypted content!"); |
|
} |
|
|
$msg .= "\0" x (MD5_CBLOCK - length($msg)); |
if ($self->{version} == 4) { |
|
$self->{digest} ||= _calc_keys( $pass ); |
|
my $acct = _decrypt_v4($rec->{encrypted}, $self->{digest}); |
|
$acct->{name} ||= $rec->{name}; |
|
return $acct; |
|
} elsif ($self->{version} == 5) { |
|
my $fields = _decrypt_v5( |
|
$rec->{encrypted}, $rec->{ivec}, $self->{key}, |
|
$self->{appinfo}->{keylen}, $self->{appinfo}->{cipher_name}, |
|
); |
|
if ($self->{options}->{v4compatible}) { |
|
my %acct; |
|
foreach my $f (@{ $fields }) { |
|
$acct{ $f->{label} } = $f->{data}; |
|
} |
|
$acct{name} ||= $rec->{name}; |
|
return \%acct; |
|
} else { |
|
return $fields; |
|
} |
|
} else { |
|
# XXX Unsupported version! |
|
} |
|
return; |
|
} |
|
|
my $digest = md5($msg); |
sub _decrypt_v4 |
|
{ |
|
my $encrypted = shift; |
|
my $digest = shift; |
|
|
my $data = $salt . $digest;# . "\0"; |
my $decrypted = _crypt3des( $encrypted, $digest, $DECRYPT ); |
|
my ( $account, $password, $notes, $packeddate ) |
|
= split /$NULL/xm, $decrypted, 4; |
|
|
# AFAIK the thing we use to test the password is |
my $modified; |
# always in the first entry |
if ($packeddate) { |
$self->{records}->[0]->{data} = $data; |
$modified = _parse_keyring_date($packeddate); |
|
} |
|
|
$self->{password} = $pass; |
return { |
$self->_calc_keys(); |
account => $account, |
|
password => $password, |
|
notes => $notes, |
|
lastchange => $modified, |
|
}; |
|
} |
|
|
return 1; |
sub _decrypt_v5 |
|
{ |
|
my $encrypted = shift; |
|
my $ivec = shift; |
|
my $key = shift; |
|
my $keylen = shift; |
|
my $cipher = shift; |
|
|
|
my $decrypted; |
|
|
|
if ($cipher eq 'None') { |
|
# do nothing |
|
$decrypted = $encrypted; |
|
|
|
} elsif ($cipher eq 'DES_EDE3' or $cipher eq 'Rijndael') { |
|
my $c = _setup_cipher_v5($ivec, $key, $keylen, $cipher); |
|
if (! $c) { |
|
croak("Unable to set up encryption!"); |
|
} |
|
$encrypted .= $NULL x $keylen; # pad out a keylen |
|
$decrypted = $c->decrypt($encrypted); |
|
|
|
} else { |
|
# XXX Unknown encryption |
|
return; |
|
} |
|
|
|
my @fields; |
|
while ($decrypted) { |
|
my $field; |
|
($field, $decrypted) = _parse_field($decrypted); |
|
if (! $field) { |
|
last; |
|
} |
|
push @fields, $field; |
|
} |
|
|
|
return \@fields; |
} |
} |
|
|
|
# Password |
|
|
# XXX Have to make this encrypt as well as decrypting, but w00 h00! |
sub Password |
# do null padding on the end of a cleartext if we are going to encrypt it |
{ |
sub _crypt3des { |
my $self = shift; |
my ( $self, $plaintext, $flag ) = @_; |
my $pass = shift; |
|
my $new_pass = shift; |
|
|
my $passphrase = $self->{digest} || $self->_calc_keys(); |
if (! $pass) { |
$passphrase .= ' ' x (16*3); |
delete $self->{password}; |
my $cyphertext = ""; |
return 1; |
|
} |
|
|
|
if (! exists $self->{records}) { |
|
# Give the PDB the first record that will hold the encrypted password |
|
$self->{records} = [ $self->new_Record ]; |
|
|
my $size = length ( $plaintext ); |
return $self->_password_update($pass); |
print "STRING: '$plaintext' - Length: " . length($plaintext) . "\n"; |
} |
|
|
# This check should see if it is plaintext first, if it is, |
if ($new_pass) { |
# pad it with \000 |
my @accts = (); |
# if not, then die |
foreach my $i (0..$#{ $self->{records} }) { |
die "record not 8 byte padded" if (length($plaintext) % 8) && ! $flag; |
if ($i == 0) { |
|
push @accts, undef; |
|
next; |
|
} |
|
my $acct = $self->Decrypt($self->{records}->[$i], $pass); |
|
if ( ! $acct ) { |
|
croak("Couldn't decrypt $self->{records}->[$i]->{name}"); |
|
} |
|
push @accts, $acct; |
|
} |
|
|
my %C; |
if ( ! $self->_password_update($new_pass)) { |
for ( 0..2 ) { |
croak("Couldn't set new password!"); |
$C{$_} = new Crypt::DES( pack( "H*", substr($passphrase, 16*$_, 16 ))); |
} |
|
$pass = $new_pass; |
|
|
|
foreach my $i (0..$#accts) { |
|
next if $i == 0; |
|
delete $self->{records}->[$i]->{encrypted}; |
|
$self->Encrypt($self->{records}->[$i], $accts[$i], $pass); |
|
} |
} |
} |
|
|
for ( 0 .. (($size)/8) - 1) { |
if (defined $self->{password} && $pass eq $self->{password}) { |
my $pt = substr( $plaintext, $_*8, 8 ); |
# already verified this password |
print "PT: '$pt' - Length: " . length($pt) . "\n"; |
return 1; |
if (length($pt) < 8) { |
} |
my $len = 8 - length($pt); |
|
print "LENGTH: $len\n"; |
if ($self->{version} == 4) { |
print "Binary: '" . unpack("b*", $pt) . "'\n"; |
# AFAIK the thing we use to test the password is |
$pt .= (chr(0) x $len);# . $pt; |
# always in the first entry |
print "Binary: '" . unpack("b*", $pt) . "'\n"; |
my $valid = _password_verify_v4($pass, $self->{records}->[0]->{data}); |
print "PT: '$pt' - Length: " . length($pt) . "\n"; |
|
|
# May as well generate the keys we need now, since we know the password is right |
|
if ($valid) { |
|
$self->{digest} = _calc_keys($pass); |
|
if ($self->{digest} ) { |
|
$self->{password} = $pass; |
|
return 1; |
|
} |
} |
} |
$pt = $C{0}->decrypt( $pt ); |
} elsif ($self->{version} == 5) { |
$pt = $C{1}->encrypt( $pt ); |
$self->{key} = _password_verify_v5($pass, $self->{appinfo}); |
$pt = $C{2}->decrypt( $pt ); |
return 1 if $self->{key}; |
print "PT: '$pt' - Length: " . length($pt) . "\n"; |
} else { |
$cyphertext .= $pt; |
# XXX unsupported version |
} |
} |
|
|
return substr ( $cyphertext, 0, $size ); |
return; |
} |
} |
|
|
|
sub _password_verify_v4 |
|
{ |
|
my $pass = shift; |
|
my $data = shift; |
|
|
|
if (! $pass) { croak('No password specified!'); }; |
|
|
|
# XXX die "No encrypted password in file!" unless defined $data; |
|
if ( ! defined $data) { return; }; |
|
|
|
$data =~ s/$NULL$//xm; |
|
|
|
my $salt = substr $data, 0, $kSalt_Size; |
|
|
|
my $msg = $salt . $pass; |
|
$msg .= "\0" x ( $MD5_CBLOCK - length $msg ); |
|
|
|
my $digest = md5($msg); |
|
|
|
if (! $data eq $salt . $digest ) { |
|
return; |
|
} |
|
|
|
return 1; |
|
} |
|
|
|
sub _password_verify_v5 |
|
{ |
|
my $pass = shift; |
|
my $appinfo = shift; |
|
|
|
my $salt = pack("H*", $appinfo->{salt}); |
|
|
|
my $key = _pbkdf2( |
|
$pass, $salt, $appinfo->{iter}, $appinfo->{keylen}, \&hmac_sha1 |
|
); |
|
if ($appinfo->{DES_odd_parity}) { |
|
$key = DES_odd_parity($key); |
|
} |
|
|
|
my $newhash = unpack("H*", substr(sha1($key.$salt),0, 8)); |
|
|
|
#print "Key: '". unpack("H*", $key) . "'\n"; |
|
#print "Hash: '". $newhash . "'\n"; |
|
#print "Hash: '". $appinfo->{masterhash} . "'\n"; |
|
|
|
if ($appinfo->{masterhash} eq $newhash) { |
|
$appinfo->{key} = $key; |
|
} else { |
|
return; |
|
} |
|
return $key; |
|
} |
|
|
|
# V4 helpers |
|
|
|
sub _calc_keys |
|
{ |
|
my $pass = shift; |
|
if (! defined $pass) { croak('No password defined!'); }; |
|
|
|
my $digest = md5($pass); |
|
|
|
my ( $key1, $key2 ) = unpack 'a8a8', $digest; |
|
|
|
#-------------------------------------------------- |
|
# print "key1: $key1: ", length $key1, "\n"; |
|
# print "key2: $key2: ", length $key2, "\n"; |
|
#-------------------------------------------------- |
|
|
|
$digest = unpack 'H*', $key1 . $key2 . $key1; |
|
|
|
#-------------------------------------------------- |
|
# print "Digest: ", $digest, "\n"; |
|
# print length $digest, "\n"; |
|
#-------------------------------------------------- |
|
|
|
return $digest; |
|
} |
|
|
|
sub _crypt3des |
|
{ |
|
my ( $plaintext, $passphrase, $flag ) = @_; |
|
|
|
$passphrase .= $SPACE x ( 16 * 3 ); |
|
my $cyphertext = $EMPTY; |
|
|
|
my $size = length $plaintext; |
|
|
|
#print "STRING: '$plaintext' - Length: " . (length $plaintext) . "\n"; |
|
|
|
my @C; |
|
for ( 0 .. 2 ) { |
|
$C[$_] = |
|
new Crypt::DES( pack 'H*', ( substr $passphrase, 16 * $_, 16 )); |
|
} |
|
|
|
for ( 0 .. ( ($size) / 8 ) ) { |
|
my $pt = substr $plaintext, $_ * 8, 8; |
|
|
|
#print "PT: '$pt' - Length: " . length($pt) . "\n"; |
|
if (! length $pt) { next; }; |
|
if ( (length $pt) < 8 ) { |
|
if ($flag == $DECRYPT) { croak('record not 8 byte padded'); }; |
|
my $len = 8 - (length $pt); |
|
$pt .= ($NULL x $len); |
|
} |
|
if ( $flag == $ENCRYPT ) { |
|
$pt = $C[0]->encrypt($pt); |
|
$pt = $C[1]->decrypt($pt); |
|
$pt = $C[2]->encrypt($pt); |
|
} |
|
else { |
|
$pt = $C[0]->decrypt($pt); |
|
$pt = $C[1]->encrypt($pt); |
|
$pt = $C[2]->decrypt($pt); |
|
} |
|
|
|
#print "PT: '$pt' - Length: " . length($pt) . "\n"; |
|
$cyphertext .= $pt; |
|
} |
|
|
|
$cyphertext =~ s/$NULL+$//xm; |
|
|
|
#print "CT: '$cyphertext' - Length: " . length($cyphertext) . "\n"; |
|
|
|
return $cyphertext; |
|
} |
|
|
|
# V5 helpers |
|
|
|
sub _setup_cipher_v5 |
|
{ |
|
my $ivec = shift; |
|
my $key = shift; |
|
my $keylen = shift; |
|
my $cipher = shift; |
|
|
|
return Crypt::CBC->new( |
|
-literal_key => 1, |
|
-key => $key, |
|
-iv => $ivec, |
|
-cipher => $cipher, |
|
-keysize => $keylen, |
|
-header => 'none', |
|
-padding => 'oneandzeroes', |
|
); |
|
} |
|
|
|
sub _parse_field |
|
{ |
|
my $field = shift; |
|
|
|
my @labels; |
|
$labels[0] = 'name'; |
|
$labels[1] = 'account'; |
|
$labels[2] = 'password'; |
|
$labels[3] = 'lastchange'; |
|
$labels[255] = 'notes'; |
|
|
|
my ($len) = unpack "S1", $field; |
|
if ($len + 4 > length $field) { |
|
return undef, $field; |
|
} |
|
my $unpackstr = "S1 C1 C1 A$len"; |
|
if ($len % 2) { |
|
# trim the 0/1 byte padding for next even address. |
|
$unpackstr .= ' x' |
|
} |
|
$unpackstr .= ' A*'; |
|
|
|
my (undef, $label, $font, $data, $leftover) |
|
= unpack $unpackstr, $field; |
|
|
|
if ($label == 3) { |
|
$data = _parse_keyring_date($data); |
|
} |
|
return { |
|
#len => $len, |
|
label => $labels[ $label ] || $label, |
|
label_id => $label, |
|
font => $font, |
|
data => $data, |
|
}, $leftover; |
|
} |
|
|
|
# All version helpers |
|
|
|
sub _password_update |
|
{ |
|
|
|
# It is very important to Encrypt after calling this |
|
# (Although it is generally only called by Encrypt) |
|
# because otherwise the data will be out of sync with the |
|
# password, and that would suck! |
|
my $self = shift; |
|
my $pass = shift; |
|
|
|
# XXX have to separate this out to v4 and v5 sections. |
|
die "Unsupported version" unless $self->{version} == 4; |
|
|
|
if (! defined $pass) { croak('No password specified!'); }; |
|
|
|
my $salt; |
|
for ( 1 .. $kSalt_Size ) { |
|
$salt .= chr int rand 255; |
|
} |
|
|
|
my $msg = $salt . $pass; |
|
|
|
$msg .= "\0" x ( $MD5_CBLOCK - length $msg ); |
|
|
|
my $digest = md5($msg); |
|
|
|
my $data = $salt . $digest; # . "\0"; |
|
|
|
# AFAIK the thing we use to test the password is |
|
# always in the first entry |
|
$self->{records}->[0]->{data} = $data; |
|
|
|
$self->{password} = $pass; |
|
$self->{digest} = _calc_keys( $self->{password} ); |
|
|
|
return 1; |
|
} |
|
|
|
sub _hexdump |
|
{ |
|
my $prefix = shift; # What to print in front of each line |
|
my $data = shift; # The data to dump |
|
my $maxlines = shift; # Max # of lines to dump |
|
my $offset; # Offset of current chunk |
|
|
|
for ($offset = 0; $offset < length($data); $offset += 16) |
|
{ |
|
my $hex; # Hex values of the data |
|
my $ascii; # ASCII values of the data |
|
my $chunk; # Current chunk of data |
|
|
|
last if defined($maxlines) && ($offset >= ($maxlines * 16)); |
|
|
|
$chunk = substr($data, $offset, 16); |
|
|
|
($hex = $chunk) =~ s/./sprintf "%02x ", ord($&)/ges; |
|
|
|
($ascii = $chunk) =~ y/\040-\176/./c; |
|
|
|
printf "%s %-48s|%-16s|\n", $prefix, $hex, $ascii; |
|
} |
|
} |
|
|
|
sub _bindump |
|
{ |
|
my $prefix = shift; # What to print in front of each line |
|
my $data = shift; # The data to dump |
|
my $maxlines = shift; # Max # of lines to dump |
|
my $offset; # Offset of current chunk |
|
|
|
for ($offset = 0; $offset < length($data); $offset += 8) |
|
{ |
|
my $bin; # binary values of the data |
|
my $ascii; # ASCII values of the data |
|
my $chunk; # Current chunk of data |
|
|
|
last if defined($maxlines) && ($offset >= ($maxlines * 8)); |
|
|
|
$chunk = substr($data, $offset, 8); |
|
|
|
($bin = $chunk) =~ s/./sprintf "%08b ", ord($&)/ges; |
|
|
|
($ascii = $chunk) =~ y/\040-\176/./c; |
|
|
|
printf "%s %-72s|%-8s|\n", $prefix, $bin, $ascii; |
|
} |
|
} |
|
|
|
# Thanks to Jochen Hoenicke <hoenicke@gmail.com> |
|
# (one of the authors of Palm Keyring) |
|
# for these next two subs. |
|
|
|
# Usage pbkdf2(password, salt, iter, keylen, prf) |
|
# iter is number of iterations |
|
# keylen is length of generated key in bytes |
|
# prf is the pseudo random function (e.g. hmac_sha1) |
|
# returns the key. |
|
sub _pbkdf2($$$$$) |
|
{ |
|
my ($password, $salt, $iter, $keylen, $prf) = @_; |
|
my ($k, $t, $u, $ui, $i); |
|
$t = ""; |
|
for ($k = 1; length($t) < $keylen; $k++) { |
|
$u = $ui = &$prf($salt.pack('N', $k), $password); |
|
for ($i = 1; $i < $iter; $i++) { |
|
$ui = &$prf($ui, $password); |
|
$u ^= $ui; |
|
} |
|
$t .= $u; |
|
} |
|
return substr($t, 0, $keylen); |
|
} |
|
|
|
sub DES_odd_parity($) { |
|
my $key = $_[0]; |
|
my ($r, $i); |
|
my @odd_parity = ( |
|
1, 1, 2, 2, 4, 4, 7, 7, 8, 8, 11, 11, 13, 13, 14, 14, |
|
16, 16, 19, 19, 21, 21, 22, 22, 25, 25, 26, 26, 28, 28, 31, 31, |
|
32, 32, 35, 35, 37, 37, 38, 38, 41, 41, 42, 42, 44, 44, 47, 47, |
|
49, 49, 50, 50, 52, 52, 55, 55, 56, 56, 59, 59, 61, 61, 62, 62, |
|
64, 64, 67, 67, 69, 69, 70, 70, 73, 73, 74, 74, 76, 76, 79, 79, |
|
81, 81, 82, 82, 84, 84, 87, 87, 88, 88, 91, 91, 93, 93, 94, 94, |
|
97, 97, 98, 98,100,100,103,103,104,104,107,107,109,109,110,110, |
|
112,112,115,115,117,117,118,118,121,121,122,122,124,124,127,127, |
|
128,128,131,131,133,133,134,134,137,137,138,138,140,140,143,143, |
|
145,145,146,146,148,148,151,151,152,152,155,155,157,157,158,158, |
|
161,161,162,162,164,164,167,167,168,168,171,171,173,173,174,174, |
|
176,176,179,179,181,181,182,182,185,185,186,186,188,188,191,191, |
|
193,193,194,194,196,196,199,199,200,200,203,203,205,205,206,206, |
|
208,208,211,211,213,213,214,214,217,217,218,218,220,220,223,223, |
|
224,224,227,227,229,229,230,230,233,233,234,234,236,236,239,239, |
|
241,241,242,242,244,244,247,247,248,248,251,251,253,253,254,254); |
|
for ($i = 0; $i< length($key); $i++) { |
|
$r .= chr($odd_parity[ord(substr($key, $i, 1))]); |
|
} |
|
return $r; |
|
} |
|
|
1; |
1; |
__END__ |
__END__ |
|
|
|
=head1 NAME |
|
|
|
Palm::Keyring - Handler for Palm Keyring databases. |
|
|
|
=head1 DESCRIPTION |
|
|
|
The Keyring PDB handler is a helper class for the Palm::PDB package. It |
|
parses Keyring for Palm OS databases. See |
|
L<http://gnukeyring.sourceforge.net/>. |
|
|
|
It has the standard Palm::PDB methods with 2 additional public methods. |
|
Decrypt and Encrypt. |
|
|
|
It currently supports the v4 Keyring databases. The v5 databases from |
|
the pre-release keyring-2.0 are not supported. |
|
|
|
This module doesn't store the decrypted content. It only keeps it until it |
|
returns it to you or encrypts it. |
|
|
|
=head1 SYNOPSIS |
|
|
|
use Palm::PDB; |
|
use Palm::Keyring; |
|
|
|
my $pass = 'password'; |
|
my $file = 'Keys-Gtkr.pdb'; |
|
my $pdb = new Palm::PDB; |
|
$pdb->Load($file); |
|
|
|
foreach (0..$#{ $pdb->{records} }) { |
|
next if $_ = 0; # skip the password record |
|
my $rec = $pdb->{records}->[$_]; |
|
my $acct = $pdb->Decrypt($rec, $pass); |
|
print $rec->{name}, ' - ', $acct->{account}, "\n"; |
|
} |
|
|
|
=head1 SUBROUTINES/METHODS |
|
|
|
=head2 new |
|
|
|
$pdb = new Palm::Keyring([$password]); |
|
|
|
Create a new PDB, initialized with the various Palm::Keyring fields |
|
and an empty record list. |
|
|
|
Use this method if you're creating a Keyring PDB from scratch otherwise you |
|
can just use Palm::PDB::new() before calling Load(). |
|
|
|
If you pass in a password, it will initalize the first record with the encrypted |
|
password. |
|
|
|
=head2 Encrypt |
|
|
|
$pdb->Encrypt($rec, $acct[, $password]); |
|
|
|
Encrypts an account into a record, either with the password previously |
|
used, or with a password that is passed. |
|
|
|
$rec is a record from $pdb->{records} or a new_Record(). |
|
$acct is a hashref in the format below. |
|
|
|
my $acct = { |
|
name => $rec->{name}, |
|
account => $account, |
|
password => $password, |
|
notes => $notes, |
|
lastchange => { |
|
year => 107, # years since 1900 |
|
month => 0, # 0-11, 0 = January, 11 = December |
|
day => 30, # 1-31, same as localtime |
|
}, |
|
}; |
|
|
|
If you have changed anything other than the lastchange, or don't pass in a |
|
lastchange key, Encrypt() will generate a new lastchange date for you. |
|
|
|
If you pass in a lastchange field that is different than the one in the |
|
record, it will honor what you passed in. |
|
|
|
Encrypt() only uses the $acct->{name} if there is not already a $rec->{name}. |
|
|
|
=head2 Decrypt |
|
|
|
my $acct = $pdb->Decrypt($rec[, $password]); |
|
|
|
Decrypts the record and returns a hashref for the account as described |
|
under Encrypt(). |
|
|
|
foreach (0..$#{ $pdb->{records}) { |
|
next if $_ == 0; |
|
my $rec = $pdb->{records}->[$_]; |
|
my $acct = $pdb->Decrypt($rec[, $password]); |
|
# do something with $acct |
|
} |
|
|
|
=head2 Password |
|
|
|
$pdb->Password([$password[, $new_password]]); |
|
|
|
Either sets the password to be used to crypt, or if you pass $new_password, |
|
changes the password on the database. |
|
|
|
If you have created a new $pdb, and you didn't set a password when you |
|
called new(), you only need to pass one password and it will set that as |
|
the password. |
|
|
|
If nothing is passed, it forgets the password that it was remembering. |
|
|
|
=head1 DEPENDENCIES |
|
|
|
Palm::StdAppInfo |
|
|
|
Digest::MD5 |
|
|
|
Crypt::DES |
|
|
|
Readonly |
|
|
|
=head1 THANKS |
|
|
|
I would like to thank the helpful Perlmonk shigetsu who gave me some great advice |
|
and helped me get my first module posted. L<http://perlmonks.org/?node_id=596998> |
|
|
|
I would also like to thank |
|
Johan Vromans |
|
E<lt>jvromans@squirrel.nlE<gt> -- |
|
L<http://www.squirrel.nl/people/jvromans>. |
|
He had his own Palm::KeyRing module that he posted a couple of days before |
|
mine was ready and he was kind enough to let me have the namespace as well |
|
as giving me some very helpful hints about doing a few things that I was |
|
unsure of. He is really great. |
|
|
|
=head1 BUGS AND LIMITATIONS |
|
|
|
Please report any bugs or feature requests to |
|
C<bug-palm-keyring at rt.cpan.org>, or through the web interface at |
|
L<http://rt.cpan.org>. I will be notified, and then you'll automatically be |
|
notified of progress on your bug as I make changes. |
|
|
=head1 AUTHOR |
=head1 AUTHOR |
|
|
Andrew Fresh E<lt>andrew@mad-techies.org<gt> |
Andrew Fresh E<lt>andrew@cpan.orgE<gt> |
|
|
|
=head1 LICENSE AND COPYRIGHT |
|
|
|
Copyright 2004, 2005, 2006, 2007 Andrew Fresh, All Rights Reserved. |
|
|
|
This program is free software; you can redistribute it and/or |
|
modify it under the same terms as Perl itself. |
|
|
=head1 SEE ALSO |
=head1 SEE ALSO |
|
|
Palm::PDB(3) |
Palm::PDB(3) |
|
|
Palm::StdAppInfo(3) |
Palm::StdAppInfo(3) |
|
|
=cut |
The Keyring for Palm OS website: |
|
L<http://gnukeyring.sourceforge.net/> |
|
|
|
Johan Vromans also has a wxkeyring app that now uses this module, available |
|
from his website at L<http://www.vromans.org/johan/software/sw_palmkeyring.html> |