[BACK]Return to Keyring.pm CVS log [TXT][DIR] Up to [local] / palm / Palm-Keyring / lib / Palm

Diff for /palm/Palm-Keyring/lib/Palm/Keyring.pm between version 1.4 and 1.28

version 1.4, 2006/11/10 04:21:17 version 1.28, 2007/02/18 05:50:25
Line 1 
Line 1 
 # Palm::Keyring.pm  package Palm::Keyring;
   # $RedRiver: Keyring.pm,v 1.27 2007/02/10 16:21:28 andrew Exp $
   ########################################################################
   # Keyring.pm *** Perl class for Keyring for Palm OS databases.
 #  #
 # Perl class for dealing with Keyring for Palm OS databases.  
 #  
 #       Copyright (C) 2004, Andrew Fresh  
 #       You may distribute this file under the terms of the Artistic  
 #       License, as specified in the README file distributed with the p5-Palm distribution.  
 #  
 #   This started as Memo.pm, I just made it work for Keyring.  #   This started as Memo.pm, I just made it work for Keyring.
 #  #
 # $Id$  # 2006.01.26 #*#*# andrew fresh <andrew@cpan.org>
 # $RedRiver: Keyring.pm,v 1.3 2006/02/02 00:59:08 andrew Exp $  ########################################################################
   # Copyright (C) 2006, 2007 by Andrew Fresh
   #
   # This program is free software; you can redistribute it and/or modify
   # it under the same terms as Perl itself.
   ########################################################################
 use strict;  use strict;
 package Palm::Keyring;  use warnings;
 use Palm::Raw();  
 use Palm::StdAppInfo();  
 use vars qw( $VERSION @ISA );  
   
   use Carp;
   
   use base qw/ Palm::StdAppInfo /;
   
   use Digest::HMAC_SHA1 qw(hmac_sha1);
   use Digest::SHA1 qw(sha1);
   use Crypt::CBC;
   
 use Digest::MD5 qw(md5);  use Digest::MD5 qw(md5);
 use Crypt::DES;  use Crypt::DES;
   
 use constant ENCRYPT    =>  1;  my $ENCRYPT    = 1;
 use constant DECRYPT    =>  0;  my $DECRYPT    = 0;
 use constant MD5_CBLOCK => 64;  my $MD5_CBLOCK = 64;
 my $kSaltSize = 4;  my $kSalt_Size = 4;
   my $EMPTY      = q{};
   my $SPACE      = q{ };
   my $NULL       = chr 0;
   
   my @CRYPTS = (
       { # None
           name      => 'None',
           keylen    => 8,
           blocksize => 1,
       },
       { # DES-EDE3
           name      => 'DES_EDE3',
           keylen    => 24,
           blocksize =>  8,
           DES_odd_parity => 1,
       },
       { # AES128
           name      => 'Rijndael',
           keylen    => 16,
           blocksize => 16,
       },
       { # AES256
           name      => 'Rijndael',
           keylen    => 32,
           blocksize => 16,
       },
   );
   
 # One liner, to allow MakeMaker to work.  
 $VERSION = do { my @r = (q$Revision$ =~ /\d+/g); sprintf "%d."."%02d" x $#r, @r };  
   
 @ISA = qw( Palm::StdAppInfo Palm::Raw );  our $VERSION = 0.95;
   
 =head1 NAME  sub new
   {
       my $classname = shift;
       my $options = {};
   
 Palm::Keyring - Handler for Palm Keyring databases.      # hashref arguments
       if (ref $_[0] eq 'HASH') {
         $options = shift;
       }
   
 =head1 SYNOPSIS      # CGI style arguments
       elsif ($_[0] =~ /^-[a-zA-Z_]{1,20}$/) {
         my %tmp = @_;
         while ( my($key,$value) = each %tmp) {
           $key =~ s/^-//;
           $options->{lc $key} = $value;
         }
       }
   
     use Palm::Keyring;      else {
         $pdb->Decrypt('mypassword');          $options->{password} = shift;
           $options->{version}  = shift;
       }
   
 =head1 DESCRIPTION      # Create a generic PDB. No need to rebless it, though.
       my $self = $classname->SUPER::new();
   
 The Keyring PDB handler is a helper class for the Palm::PDB package. It      $self->{name}    = 'Keys-Gtkr';    # Default
 parses Keyring databases.  See      $self->{creator} = 'Gtkr';
 L<http://gnukeyring.sourceforge.net/>.      $self->{type}    = 'Gkyr';
   
 It is just the standard Palm::Raw with 2 additional public methods.  Decrypt and Encrypt.      # The PDB is not a resource database by
       # default, but it's worth emphasizing,
       # since MemoDB is explicitly not a PRC.
       $self->{attributes}{resource} = 0;
   
 =cut      # Set the version
 =head2 new      $self->{version} = $options->{version} || 4;
   
   $pdb = new Palm::Keyring ('password');      # Set options
       $self->{options} = $options;
   
 Create a new PDB, initialized with the various Palm::Keyring fields      if ( defined $options->{password} ) {
 and an empty record list.          $self->Password($options->{password});
       }
   
 Use this method if you're creating a Keyring PDB from scratch.      return $self;
   }
   
 =cut  sub import
 #'  
 sub new  
 {  {
         my $classname   = shift;      Palm::PDB::RegisterPDBHandlers( __PACKAGE__, [ 'Gtkr', 'Gkyr' ], );
         my $pass = shift;      return 1;
   }
   
         my $self        = $classname->SUPER::new(@_);  # PackRecord
                         # Create a generic PDB. No need to rebless it,  
                         # though.  
   
         $self->{name} = "Keys-Gtkr";    # Default  sub ParseRecord
         $self->{creator} = "Gtkr";  {
         $self->{type} = "Gkyr";      my $self     = shift;
         $self->{attributes}{resource} = 0;  
                                 # The PDB is not a resource database by  
                                 # default, but it's worth emphasizing,  
                                 # since MemoDB is explicitly not a PRC.  
   
         # Initialize the AppInfo block      my $rec = $self->SUPER::ParseRecord(@_);
         $self->{appinfo} = {};      return $rec if ! exists $rec->{data};
   
         # Add the standard AppInfo block stuff      if ($self->{version} == 4) {
         &Palm::StdAppInfo::seed_StdAppInfo($self->{appinfo});          # skip the first record because it contains the password.
           return $rec if ! exists $self->{records};
   
         # Set the version          my ( $name, $encrypted ) = split /$NULL/xm, $rec->{data}, 2;
         $self->{version} = 4;  
   
         # Give the PDB the first record that will hold the encrypted password          return $rec if ! $encrypted;
         $self->{records} = [          $rec->{name}      = $name;
                 {          $rec->{encrypted} = $encrypted;
                   'category' => 0,          delete $rec->{data};
                   'attributes' => {  
                                                         'private' => 1,  
                                                         'Secret' => 1,  
                                                         'Dirty' => 1,  
                                                         'dirty' => 1  
                                                   },  
                 },  
         ];  
   
         if ($pass) {      } elsif ($self->{version} == 5) {
                 $self->Encrypt($pass);          my $blocksize = $self->{appinfo}->{blocksize};
         }          my ($field, $extra) = _parse_field($rec->{data});
           my ($ivec, $encrypted) = unpack "A$blocksize A*", $extra;
   
         return $self;          if ($self->{options}->{v4compatible}) {
               $rec->{name} = $field->{data};
           } else {
               $rec->{name} = $field;
           }
           $rec->{ivec}      = $ivec;
           $rec->{encrypted} = $encrypted;
   
       } else {
           # XXX Unsupported version!
           return;
       }
   
       return $rec;
 }  }
   
 sub import  sub _parse_keyring_date
 {  {
         &Palm::PDB::RegisterPDBHandlers(__PACKAGE__,      my $data = shift;
                 [ "Gtkr", "Gkyr" ],  
                 );      my $u = unpack 'n', $data;
       my $year  = (($u & 0xFE00) >> 9) + 4; # since 1900
       my $month = (($u & 0x01E0) >> 5) - 1; # 0-11
       my $day   = (($u & 0x001F) >> 0);     # 1-31
   
       return {
           year   => $year,
           month  => $month || 0,
           day    => $day   || 1,
       };
 }  }
   
 sub Load  # PackRecord
   
   sub PackRecord
 {  {
         my $self = shift;      my $self = shift;
         $self->SUPER::Load(@_);      my $rec  = shift;
   
         # Skip the first 2 records because they are special      if ($self->{version} == 4) {
         # and don't have any plaintext          if ($rec->{encrypted}) {
         my $skip = 0;              if (! defined $rec->{name}) {
         foreach my $record (@{ $self->{records} }) {                  $rec->{name} = $EMPTY;
                 if ($skip < 2) {              }
                         $skip++;              $rec->{data} = join $NULL, $rec->{name}, $rec->{encrypted};
                         next;              delete $rec->{name};
                 }              delete $rec->{encrypted};
                 my ($name, $encrypted) = split /\000/, $record->{data}, 2;          }
                 $record->{plaintext}->{name} = $name;      } elsif ($self->{version} == 5) {
         $record->{encrypted} = $encrypted;          # XXX do something
         }      } else {
         1;          # XXX Unsupported version!
           return;
       }
   
       return $self->SUPER::PackRecord($rec, @_);
 }  }
   
 sub Encrypt  sub _pack_keyring_date
 {  {
         my $self = shift;      my $d = shift;
         my $pass = shift;      my $year  = $d->{year};
       my $month = $d->{month};
       my $day   = $d->{day};
   
         if ($pass) {      $year -= 4;
                 unless ($self->_keyring_verify($pass) ) {      $month++;
                         # This would encrypt with a new password.  
                         # First decrypting everything with the old password of course.  
                         $self->_keyring_update($pass) || return undef;  
                         $self->_keyring_verify($pass) || return undef;  
                 }  
         }  
   
         my $seen_enc_pass = 0;      return pack 'n', $day | ($month << 5) | ($year << 9);
         foreach my $record (@{ $self->{records} }) {  }
                 unless ($seen_enc_pass) {  
                         $seen_enc_pass = 1;  
                         next;  
                 }  
   
                 next unless defined $record->{plaintext};  # ParseAppInfoBlock
   
                 my $name        = defined $record->{plaintext}->{name}        ? $record->{plaintext}->{name}        : '';  sub ParseAppInfoBlock
                 my $account     = defined $record->{plaintext}->{account}     ? $record->{plaintext}->{account}     : '';  {
                 my $password    = defined $record->{plaintext}->{password}    ? $record->{plaintext}->{password}    : '';      my $self = shift;
                 my $description = defined $record->{plaintext}->{description} ? $record->{plaintext}->{description} : '';      my $data = shift;
                 my $extra       = '';      my $appinfo = {};
   
                 my $plaintext = join("\000", $account, $password, $description, $extra);      &Palm::StdAppInfo::parse_StdAppInfo($appinfo, $data);
   
                 my $encrypted = $self->_crypt3des($plaintext, ENCRYPT);      # int8/uint8
       # - Signed or Unsigned Byte (8 bits). C types: char, unsigned char
       # int16/uint16
       # - Signed or Unsigned Word (16 bits). C types: short, unsigned short
       # int32/uint32
       # - Signed or Unsigned Doubleword (32 bits). C types: int, unsigned int
       # sz
       # - Zero-terminated C-style string
   
                 $record->{data} = join("\000", $name, $encrypted);      if ($self->{version} == 4) {
         }          # Nothing extra for version 4
   
         return 1;      } elsif ($self->{version} == 5) {
           _parse_appinfo_v5($appinfo) || return;
   
       } else {
           # XXX Unknown version
           return;
       }
   
       return $appinfo;
 }  }
   
 sub Decrypt  sub _parse_appinfo_v5
 {  {
         my $self = shift;      my $appinfo = shift;
         my $pass = shift;  
   
         if ($pass) {      if (! exists $appinfo->{other}) {
                 $self->_keyring_verify($pass) || return undef;          # XXX Corrupt appinfo?
         }          return;
       }
   
         my $seen_enc_pass = 0;      my $unpackstr
         foreach my $record (@{ $self->{records} }) {          = ("C1" x 8)  # 8 uint8s in an array for the salt
                 unless ($seen_enc_pass) {          . ("S1" x 2)  # the iter (uint16) and the cipher (uint16)
                         # need to skip the first record because it is the encrypted password          . ("C1" x 8); # and finally 8 more uint8s for the hash
                         $seen_enc_pass = 1;  
                         next;  
                 }  
   
                 next unless defined $record->{data};      my (@salt, $iter, $cipher, @hash);
       (@salt[0..7], $iter, $cipher, @hash[0..7])
           = unpack $unpackstr, $appinfo->{other};
   
                 my ($name, $encrypted) = split /\000/, $record->{data}, 2;      $appinfo->{salt}           = sprintf "%02x" x 8, @salt;
                 $record->{plaintext}->{name} = $name;      $appinfo->{iter}           = $iter;
       $appinfo->{cipher}         = $cipher;
       $appinfo->{keylen}         = $CRYPTS[$appinfo->{cipher}]{keylen};
       $appinfo->{blocksize}      = $CRYPTS[$appinfo->{cipher}]{blocksize};
       $appinfo->{DES_odd_parity} = $CRYPTS[$appinfo->{cipher}]{DES_odd_parity};
       $appinfo->{cipher_name}    = $CRYPTS[$appinfo->{cipher}]{name};
       $appinfo->{masterhash}     = sprintf "%02x" x 8, @hash;
       delete $appinfo->{other};
   
                 my $decrypted = $self->_crypt3des($encrypted, DECRYPT);      return $appinfo
                 my ($account, $password, $description, $extra)  }
                       = split /\000/, $decrypted, 4;  
   
                 $record->{plaintext}->{account}     = defined $account     ? $account     : '';  # PackAppInfoBlock
                 $record->{plaintext}->{password}    = defined $password    ? $password    : '';  
                 $record->{plaintext}->{description} = defined $description ? $description : '';  
   
         #print "Name:      '$name'\n";  sub PackAppInfoBlock
         #print "Encrypted: '$encrypted' - Length: " . length($encrypted) . "\n";  {
         #print "Hex:       '" . unpack("H*", $encrypted) . "'\n";      my $self = shift;
         #print "Binary:    '" . unpack("b*", $encrypted) . "'\n";      my $retval;
         #print "Decrypted: '$decrypted' - Length: " . length($decrypted) . "\n";  
         #print "Hex:       '" . unpack("H*", $decrypted) . "'\n";  
         #print "Binary:    '" . unpack("b*", $decrypted) . "'\n";  
         #print "\n";  
                 #print "Extra: $extra\n";  
                 #--------------------------------------------------  
                 # print "Account:     $account\n";  
                 # print "Password:    $password\n";  
                 # print "Description: $description\n";  
                 #--------------------------------------------------  
   
         }      if ($self->{version} == 4) {
           # Nothing to do for v4
   
         return 1;      } elsif ($self->{version} == 5) {
           croak("Unsupported version!");
           #$self->{appinfo}{other} = <pack application-specific data>;
       } else {
           # XXX Unknown version
           return;
       }
       return &Palm::StdAppInfo::pack_StdAppInfo($self->{appinfo});
 }  }
   
 sub _calc_keys  # Encrypt
   
   sub Encrypt
 {  {
         my $self = shift;      my $self = shift;
       my $rec  = shift;
       my $data = shift;
       my $pass = shift || $self->{password};
   
         my $pass = $self->{'password'};      if ( ! $pass && ! $self->{key}) {
         die "No password defined!" unless defined $pass;          croak("password not set!\n");
       }
   
         my $digest = md5($pass);      if ( ! $rec) {
           croak("Needed parameter 'record' not passed!\n");
       }
   
         my ($key1, $key2) = unpack('a8a8', $digest);      if ( ! $data) {
         #--------------------------------------------------          croak("Needed parameter 'data' not passed!\n");
         # print "key1: $key1: ", length $key1, "\n";      }
         # print "key2: $key2: ", length $key2, "\n";  
         #--------------------------------------------------  
   
         $digest = unpack('H*', $key1 . $key2 . $key1);      if ( ! $self->Password($pass)) {
         #--------------------------------------------------          croak("Incorrect Password!\n");
         # print "Digest: ", $digest, "\n";      }
         # print length $digest, "\n";  
         #--------------------------------------------------  
   
         $self->{digest} = $digest;      if ($self->{version} == 4) {
         return $digest;          $self->{digest} ||= _calc_keys( $pass );
           my $acct = {};
           if ($rec->{encrypted}) {
               $acct = $self->Decrypt($rec, $pass);
           }
           my $encrypted = _encrypt_v4($data, $self->{digest}, $acct);
           if ($encrypted) {
               $rec->{attributes}{Dirty} = 1;
               $rec->{attributes}{dirty} = 1;
               $rec->{name}    ||= $data->{name};
               $rec->{encrypted} = $encrypted;
               return 1;
           }
       } elsif ($self->{version} == 5) {
           croak("Unsupported version!");
           return _encrypt_v5(
               $rec->{encrypted}, $rec->{ivec}, $self->{key},
               $self->{appinfo}->{keylen}, $self->{appinfo}->{cipher_name},
           );
       } else {
           # XXX Unsupported version!
       }
       return;
 }  }
   
 sub _keyring_verify  sub _encrypt_v4
 {  {
         my $self = shift;      my $data   = shift;
         my $pass = shift;      my $digest = shift;
       my $acct   = shift;
   
         die "No password specified!" unless $pass;      $data->{account}  ||= $EMPTY;
         $self->{password} = $pass;      $data->{password} ||= $EMPTY;
       $data->{notes}    ||= $EMPTY;
   
         # AFAIK the thing we use to test the password is      my $changed      = 0;
         #     always in the first entry      my $need_newdate = 0;
         my $data = $self->{records}->[0]->{data};      if (%{ $acct }) {
         #die "No encrypted password in file!" unless defined $data;          foreach my $key (keys %{ $data }) {
         return undef unless defined $data;              next if $key eq 'lastchange';
               if ($data->{$key} ne $acct->{$key}) {
                   $changed = 1;
                   last;
               }
           }
           if ( exists $data->{lastchange} && exists $acct->{lastchange} && (
               $data->{lastchange}->{day}   != $acct->{lastchange}->{day}   ||
               $data->{lastchange}->{month} != $acct->{lastchange}->{month} ||
               $data->{lastchange}->{year}  != $acct->{lastchange}->{year}
           )) {
               $changed = 1;
               $need_newdate = 0;
           } else {
               $need_newdate = 1;
           }
   
         $data =~ s/\0$//;      } else {
           $changed = 1;
       }
   
         my $salt = substr($data, 0, $kSaltSize);      # no need to re-encrypt if it has not changed.
       return 1 if ! $changed;
   
         my $msg = $salt . $pass;      my ($day, $month, $year);
   
         $msg .= "\0" x (MD5_CBLOCK - length($msg));      if ($data->{lastchange} && ! $need_newdate ) {
           $day   = $data->{lastchange}->{day}   || 1;
           $month = $data->{lastchange}->{month} || 0;
           $year  = $data->{lastchange}->{year}  || 0;
   
         my $digest = md5($msg);          # XXX Need to actually validate the above information somehow
           if ($year >= 1900) {
               $year -= 1900;
           }
       } else {
           $need_newdate = 1;
       }
   
         if ($data eq $salt . $digest) {      if ($need_newdate) {
                 # May as well generate the keys we need now, since we know the password is right          ($day, $month, $year) = (localtime)[3,4,5];
                 if ($self->_calc_keys()) {      }
                         return 1;  
                 } else {      my $packeddate = _pack_keyring_date( {
                         return undef;              year  => $year,
                 }              month => $month,
         } else {              day   => $day,
                 return undef;      });
         }  
       my $plaintext = join $NULL,
           $data->{account}, $data->{password}, $data->{notes}, $packeddate;
   
       return _crypt3des( $plaintext, $digest, $ENCRYPT );
 }  }
   
 sub _keyring_update  # Decrypt
   
   sub Decrypt
 {  {
         # It is very important to Encrypt after calling this      my $self = shift;
         #     (Although it is generally only called by Encrypt)      my $rec  = shift;
         # because otherwise the data will be out of sync with the      my $pass = shift || $self->{password};
         # password, and that would suck!  
         my $self = shift;  
         my $pass = shift;  
   
         die "No password specified!" unless $pass;      if ( ! $pass && ! $self->{key}) {
           croak("password not set!\n");
       }
   
         # if the database already has a password in it      if ( ! $rec) {
         if ($self->{records}->[0]->{data}) {          croak("Needed parameter 'record' not passed!\n");
                 # Make sure everything is decrypted before we update the keyring      }
                 $self->Decrypt() || return undef;  
         }  
   
         my $salt;      if ( ! $self->Password($pass)) {
         for (1..$kSaltSize) {          croak("Invalid Password!\n");
                 $salt .= chr(int(rand(255)));      }
         }  
   
         my $msg = $salt . $pass;      if ( ! $rec->{encrypted} ) {
           croak("No encrypted content!");
       }
   
         $msg .= "\0" x (MD5_CBLOCK - length($msg));      if ($self->{version} == 4) {
           $self->{digest} ||= _calc_keys( $pass );
           my $acct = _decrypt_v4($rec->{encrypted}, $self->{digest});
           $acct->{name} ||= $rec->{name};
           return $acct;
       } elsif ($self->{version} == 5) {
           my $fields = _decrypt_v5(
               $rec->{encrypted}, $rec->{ivec}, $self->{key},
               $self->{appinfo}->{keylen}, $self->{appinfo}->{cipher_name},
           );
           if ($self->{options}->{v4compatible}) {
               my %acct;
               foreach my $f (@{ $fields }) {
                   $acct{ $f->{label} } = $f->{data};
               }
               $acct{name} ||= $rec->{name};
               return \%acct;
           } else {
               return $fields;
           }
       } else {
           # XXX Unsupported version!
       }
       return;
   }
   
         my $digest = md5($msg);  sub _decrypt_v4
   {
       my $encrypted = shift;
       my $digest    = shift;
   
         my $data = $salt . $digest;# . "\0";      my $decrypted = _crypt3des( $encrypted, $digest, $DECRYPT );
       my ( $account, $password, $notes, $packeddate )
           = split /$NULL/xm, $decrypted, 4;
   
         # AFAIK the thing we use to test the password is      my $modified;
         #     always in the first entry      if ($packeddate) {
         $self->{records}->[0]->{data} = $data;          $modified = _parse_keyring_date($packeddate);
       }
   
         $self->{password} = $pass;      return {
         $self->_calc_keys();          account    => $account,
           password   => $password,
           notes      => $notes,
           lastchange => $modified,
       };
   }
   
         return 1;  sub _decrypt_v5
   {
       my $encrypted = shift;
       my $ivec      = shift;
       my $key       = shift;
       my $keylen    = shift;
       my $cipher    = shift;
   
       my $decrypted;
   
       if ($cipher eq 'None') {
           # do nothing
           $decrypted = $encrypted;
   
       } elsif ($cipher eq 'DES_EDE3' or $cipher eq 'Rijndael') {
           my $c = _setup_cipher_v5($ivec, $key, $keylen, $cipher);
           if (! $c) {
               croak("Unable to set up encryption!");
           }
           $encrypted .= $NULL x $keylen; # pad out a keylen
           $decrypted  = $c->decrypt($encrypted);
   
       } else {
           # XXX Unknown encryption
           return;
       }
   
       my @fields;
       while ($decrypted) {
           my $field;
           ($field, $decrypted) = _parse_field($decrypted);
           if (! $field) {
               last;
           }
           push @fields, $field;
       }
   
       return \@fields;
 }  }
   
   # Password
   
 # XXX Have to make this encrypt as well as decrypting, but w00 h00!  sub Password
 # do null padding on the end of a cleartext if we are going to encrypt it  {
 sub _crypt3des {      my $self = shift;
         my ( $self, $plaintext, $flag ) = @_;      my $pass = shift;
       my $new_pass = shift;
   
         my $passphrase = $self->{digest} || $self->_calc_keys();      if (! $pass) {
         $passphrase .= ' ' x (16*3);          delete $self->{password};
         my $cyphertext = "";          return 1;
       }
   
       if (! exists $self->{records}) {
           # Give the PDB the first record that will hold the encrypted password
           $self->{records} = [ $self->new_Record ];
   
         my $size = length ( $plaintext );          return $self->_password_update($pass);
         #print "STRING: '$plaintext' - Length: " . length($plaintext) . "\n";      }
   
         # This check should see if it is plaintext first, if it is,      if ($new_pass) {
         #   pad it with \000          my @accts = ();
         # if not, then die          foreach my $i (0..$#{ $self->{records} }) {
         die "record not 8 byte padded" if (length($plaintext) % 8) && ! $flag;              if ($i == 0) {
                   push @accts, undef;
                   next;
               }
               my $acct = $self->Decrypt($self->{records}->[$i], $pass);
               if ( ! $acct ) {
                   croak("Couldn't decrypt $self->{records}->[$i]->{name}");
               }
               push @accts, $acct;
           }
   
         my %C;          if ( ! $self->_password_update($new_pass)) {
         for ( 0..2 ) {              croak("Couldn't set new password!");
                 $C{$_} = new Crypt::DES( pack( "H*", substr($passphrase, 16*$_, 16 )));          }
         }          $pass = $new_pass;
   
         for ( 0 .. (($size)/8) - 1) {          foreach my $i (0..$#accts) {
                 my $pt = substr( $plaintext, $_*8, 8 );              next if $i == 0;
                 #print "PT: '$pt' - Length: " . length($pt) . "\n";              delete $self->{records}->[$i]->{encrypted};
                 if (length($pt) < 8) {              $self->Encrypt($self->{records}->[$i], $accts[$i], $pass);
                         my $len = 8 - length($pt);          }
                         print "LENGTH: $len\n";      }
                         print "Binary:    '" . unpack("b*", $pt) . "'\n";  
                         $pt .= (chr(0) x $len);# . $pt;  
                         print "Binary:    '" . unpack("b*", $pt) . "'\n";  
                         #print "PT: '$pt' - Length: " . length($pt) . "\n";  
                 }  
                 $pt = $C{0}->decrypt( $pt );  
                 $pt = $C{1}->encrypt( $pt );  
                 $pt = $C{2}->decrypt( $pt );  
                 #print "PT: '$pt' - Length: " . length($pt) . "\n";  
                 $cyphertext .= $pt;  
         }  
   
         return substr ( $cyphertext, 0, $size );      if (defined $self->{password} && $pass eq $self->{password}) {
           # already verified this password
           return 1;
       }
   
       if ($self->{version} == 4) {
           # AFAIK the thing we use to test the password is
           #     always in the first entry
           my $valid = _password_verify_v4($pass, $self->{records}->[0]->{data});
   
   # May as well generate the keys we need now, since we know the password is right
           if ($valid) {
               $self->{digest} = _calc_keys($pass);
               if ($self->{digest} ) {
                   $self->{password} = $pass;
                   return 1;
               }
           }
       } elsif ($self->{version} == 5) {
           $self->{key} = _password_verify_v5($pass, $self->{appinfo});
           return 1 if $self->{key};
       } else {
           # XXX unsupported version
       }
   
       return;
 }  }
   
   sub _password_verify_v4
   {
       my $pass = shift;
       my $data = shift;
   
       if (! $pass) { croak('No password specified!'); };
   
       # XXX die "No encrypted password in file!" unless defined $data;
       if ( ! defined $data) { return; };
   
       $data =~ s/$NULL$//xm;
   
       my $salt = substr $data, 0, $kSalt_Size;
   
       my $msg = $salt . $pass;
       $msg .= "\0" x ( $MD5_CBLOCK - length $msg );
   
       my $digest = md5($msg);
   
       if (! $data eq $salt . $digest ) {
           return;
       }
   
       return 1;
   }
   
   sub _password_verify_v5
   {
       my $pass    = shift;
       my $appinfo = shift;
   
       my $salt = pack("H*", $appinfo->{salt});
   
       my $key = _pbkdf2(
           $pass, $salt, $appinfo->{iter}, $appinfo->{keylen}, \&hmac_sha1
       );
       if ($appinfo->{DES_odd_parity}) {
           $key = DES_odd_parity($key);
       }
   
       my $newhash = unpack("H*", substr(sha1($key.$salt),0, 8));
   
       #print "Key:  '". unpack("H*", $key) . "'\n";
       #print "Hash: '". $newhash . "'\n";
       #print "Hash: '". $appinfo->{masterhash} . "'\n";
   
       if ($appinfo->{masterhash} eq $newhash) {
           $appinfo->{key} = $key;
       } else {
           return;
       }
       return $key;
   }
   
   # V4 helpers
   
   sub _calc_keys
   {
       my $pass = shift;
       if (! defined $pass) { croak('No password defined!'); };
   
       my $digest = md5($pass);
   
       my ( $key1, $key2 ) = unpack 'a8a8', $digest;
   
       #--------------------------------------------------
       # print "key1: $key1: ", length $key1, "\n";
       # print "key2: $key2: ", length $key2, "\n";
       #--------------------------------------------------
   
       $digest = unpack 'H*', $key1 . $key2 . $key1;
   
       #--------------------------------------------------
       # print "Digest: ", $digest, "\n";
       # print length $digest, "\n";
       #--------------------------------------------------
   
       return $digest;
   }
   
   sub _crypt3des
   {
       my ( $plaintext, $passphrase, $flag ) = @_;
   
       $passphrase   .= $SPACE x ( 16 * 3 );
       my $cyphertext = $EMPTY;
   
       my $size = length $plaintext;
   
       #print "STRING: '$plaintext' - Length: " . (length $plaintext) . "\n";
   
       my @C;
       for ( 0 .. 2 ) {
           $C[$_] =
             new Crypt::DES( pack 'H*', ( substr $passphrase, 16 * $_, 16 ));
       }
   
       for ( 0 .. ( ($size) / 8 ) ) {
           my $pt = substr $plaintext, $_ * 8, 8;
   
           #print "PT: '$pt' - Length: " . length($pt) . "\n";
           if (! length $pt) { next; };
           if ( (length $pt) < 8 ) {
               if ($flag == $DECRYPT) { croak('record not 8 byte padded'); };
               my $len = 8 - (length $pt);
               $pt .= ($NULL x $len);
           }
           if ( $flag == $ENCRYPT ) {
               $pt = $C[0]->encrypt($pt);
               $pt = $C[1]->decrypt($pt);
               $pt = $C[2]->encrypt($pt);
           }
           else {
               $pt = $C[0]->decrypt($pt);
               $pt = $C[1]->encrypt($pt);
               $pt = $C[2]->decrypt($pt);
           }
   
           #print "PT: '$pt' - Length: " . length($pt) . "\n";
           $cyphertext .= $pt;
       }
   
       $cyphertext =~ s/$NULL+$//xm;
   
       #print "CT: '$cyphertext' - Length: " . length($cyphertext) . "\n";
   
       return $cyphertext;
   }
   
   # V5 helpers
   
   sub _setup_cipher_v5
   {
       my $ivec   = shift;
       my $key    = shift;
       my $keylen = shift;
       my $cipher = shift;
   
       return Crypt::CBC->new(
           -literal_key => 1,
           -key         => $key,
           -iv          => $ivec,
           -cipher      => $cipher,
           -keysize     => $keylen,
           -header      => 'none',
           -padding     => 'oneandzeroes',
       );
   }
   
   sub _parse_field
   {
       my $field = shift;
   
       my @labels;
       $labels[0]   = 'name';
       $labels[1]   = 'account';
       $labels[2]   = 'password';
       $labels[3]   = 'lastchange';
       $labels[255] = 'notes';
   
       my ($len) = unpack "S1", $field;
       if ($len + 4 > length $field) {
           return undef, $field;
       }
       my $unpackstr = "S1 C1 C1 A$len";
       if ($len % 2) {
           # trim the 0/1 byte padding for next even address.
           $unpackstr .= ' x'
       }
       $unpackstr .= ' A*';
   
       my (undef, $label, $font, $data, $leftover)
           = unpack $unpackstr, $field;
   
       if ($label == 3) {
           $data = _parse_keyring_date($data);
       }
       return {
           #len      => $len,
           label    => $labels[ $label ] || $label,
           label_id => $label,
           font     => $font,
           data     => $data,
       }, $leftover;
   }
   
   # All version helpers
   
   sub _password_update
   {
   
       # It is very important to Encrypt after calling this
       #     (Although it is generally only called by Encrypt)
       # because otherwise the data will be out of sync with the
       # password, and that would suck!
       my $self = shift;
       my $pass = shift;
   
       # XXX have to separate this out to v4 and v5 sections.
       die "Unsupported version" unless $self->{version} == 4;
   
       if (! defined $pass) { croak('No password specified!'); };
   
       my $salt;
       for ( 1 .. $kSalt_Size ) {
           $salt .= chr int rand 255;
       }
   
       my $msg = $salt . $pass;
   
       $msg .= "\0" x ( $MD5_CBLOCK - length $msg );
   
       my $digest = md5($msg);
   
       my $data = $salt . $digest;    # . "\0";
   
       # AFAIK the thing we use to test the password is
       #     always in the first entry
       $self->{records}->[0]->{data} = $data;
   
       $self->{password} = $pass;
       $self->{digest}   = _calc_keys( $self->{password} );
   
       return 1;
   }
   
   sub _hexdump
   {
       my $prefix = shift;   # What to print in front of each line
       my $data = shift;     # The data to dump
       my $maxlines = shift; # Max # of lines to dump
       my $offset;           # Offset of current chunk
   
       for ($offset = 0; $offset < length($data); $offset += 16)
       {
           my $hex;   # Hex values of the data
           my $ascii; # ASCII values of the data
           my $chunk; # Current chunk of data
   
           last if defined($maxlines) && ($offset >= ($maxlines * 16));
   
           $chunk = substr($data, $offset, 16);
   
           ($hex = $chunk) =~ s/./sprintf "%02x ", ord($&)/ges;
   
           ($ascii = $chunk) =~ y/\040-\176/./c;
   
           printf "%s %-48s|%-16s|\n", $prefix, $hex, $ascii;
       }
   }
   
   sub _bindump
   {
       my $prefix = shift;   # What to print in front of each line
       my $data = shift;     # The data to dump
       my $maxlines = shift; # Max # of lines to dump
       my $offset;           # Offset of current chunk
   
       for ($offset = 0; $offset < length($data); $offset += 8)
       {
           my $bin;   # binary values of the data
           my $ascii; # ASCII values of the data
           my $chunk; # Current chunk of data
   
           last if defined($maxlines) && ($offset >= ($maxlines * 8));
   
           $chunk = substr($data, $offset, 8);
   
           ($bin = $chunk) =~ s/./sprintf "%08b ", ord($&)/ges;
   
           ($ascii = $chunk) =~ y/\040-\176/./c;
   
           printf "%s %-72s|%-8s|\n", $prefix, $bin, $ascii;
       }
   }
   
   # Thanks to Jochen Hoenicke <hoenicke@gmail.com>
   # (one of the authors of Palm Keyring)
   # for these next two subs.
   
   # Usage pbkdf2(password, salt, iter, keylen, prf)
   # iter is number of iterations
   # keylen is length of generated key in bytes
   # prf is the pseudo random function (e.g. hmac_sha1)
   # returns the key.
   sub _pbkdf2($$$$$)
   {
       my ($password, $salt, $iter, $keylen, $prf) = @_;
       my ($k, $t, $u, $ui, $i);
       $t = "";
       for ($k = 1; length($t) <  $keylen; $k++) {
       $u = $ui = &$prf($salt.pack('N', $k), $password);
       for ($i = 1; $i < $iter; $i++) {
           $ui = &$prf($ui, $password);
           $u ^= $ui;
       }
       $t .= $u;
       }
       return substr($t, 0, $keylen);
   }
   
   sub DES_odd_parity($) {
       my $key = $_[0];
       my ($r, $i);
       my @odd_parity = (
     1,  1,  2,  2,  4,  4,  7,  7,  8,  8, 11, 11, 13, 13, 14, 14,
    16, 16, 19, 19, 21, 21, 22, 22, 25, 25, 26, 26, 28, 28, 31, 31,
    32, 32, 35, 35, 37, 37, 38, 38, 41, 41, 42, 42, 44, 44, 47, 47,
    49, 49, 50, 50, 52, 52, 55, 55, 56, 56, 59, 59, 61, 61, 62, 62,
    64, 64, 67, 67, 69, 69, 70, 70, 73, 73, 74, 74, 76, 76, 79, 79,
    81, 81, 82, 82, 84, 84, 87, 87, 88, 88, 91, 91, 93, 93, 94, 94,
    97, 97, 98, 98,100,100,103,103,104,104,107,107,109,109,110,110,
   112,112,115,115,117,117,118,118,121,121,122,122,124,124,127,127,
   128,128,131,131,133,133,134,134,137,137,138,138,140,140,143,143,
   145,145,146,146,148,148,151,151,152,152,155,155,157,157,158,158,
   161,161,162,162,164,164,167,167,168,168,171,171,173,173,174,174,
   176,176,179,179,181,181,182,182,185,185,186,186,188,188,191,191,
   193,193,194,194,196,196,199,199,200,200,203,203,205,205,206,206,
   208,208,211,211,213,213,214,214,217,217,218,218,220,220,223,223,
   224,224,227,227,229,229,230,230,233,233,234,234,236,236,239,239,
   241,241,242,242,244,244,247,247,248,248,251,251,253,253,254,254);
       for ($i = 0; $i< length($key); $i++) {
       $r .= chr($odd_parity[ord(substr($key, $i, 1))]);
       }
       return $r;
   }
   
 1;  1;
 __END__  __END__
   
   =head1 NAME
   
   Palm::Keyring - Handler for Palm Keyring databases.
   
   =head1 DESCRIPTION
   
   The Keyring PDB handler is a helper class for the Palm::PDB package. It
   parses Keyring for Palm OS databases.  See
   L<http://gnukeyring.sourceforge.net/>.
   
   It has the standard Palm::PDB methods with 2 additional public methods.
   Decrypt and Encrypt.
   
   It currently supports the v4 Keyring databases.  The v5 databases from
   the pre-release keyring-2.0 are not supported.
   
   This module doesn't store the decrypted content.  It only keeps it until it
   returns it to you or encrypts it.
   
   =head1 SYNOPSIS
   
       use Palm::PDB;
       use Palm::Keyring;
   
       my $pass = 'password';
       my $file = 'Keys-Gtkr.pdb';
       my $pdb  = new Palm::PDB;
       $pdb->Load($file);
   
       foreach (0..$#{ $pdb->{records} }) {
           next if $_ = 0; # skip the password record
           my $rec  = $pdb->{records}->[$_];
           my $acct = $pdb->Decrypt($rec, $pass);
           print $rec->{name}, ' - ', $acct->{account}, "\n";
       }
   
   =head1 SUBROUTINES/METHODS
   
   =head2 new
   
       $pdb = new Palm::Keyring([$password]);
   
   Create a new PDB, initialized with the various Palm::Keyring fields
   and an empty record list.
   
   Use this method if you're creating a Keyring PDB from scratch otherwise you
   can just use Palm::PDB::new() before calling Load().
   
   If you pass in a password, it will initalize the first record with the encrypted
   password.
   
   =head2 Encrypt
   
       $pdb->Encrypt($rec, $acct[, $password]);
   
   Encrypts an account into a record, either with the password previously
   used, or with a password that is passed.
   
   $rec is a record from $pdb->{records} or a new_Record().
   $acct is a hashref in the format below.
   
       my $acct = {
           name       => $rec->{name},
           account    => $account,
           password   => $password,
           notes      => $notes,
           lastchange => {
               year  => 107, # years since 1900
               month =>   0, # 0-11, 0 = January, 11 = December
               day   =>  30, # 1-31, same as localtime
           },
       };
   
   If you have changed anything other than the lastchange, or don't pass in a
   lastchange key, Encrypt() will generate a new lastchange date for you.
   
   If you pass in a lastchange field that is different than the one in the
   record, it will honor what you passed in.
   
   Encrypt() only uses the $acct->{name} if there is not already a $rec->{name}.
   
   =head2 Decrypt
   
       my $acct = $pdb->Decrypt($rec[, $password]);
   
   Decrypts the record and returns a hashref for the account as described
   under Encrypt().
   
       foreach (0..$#{ $pdb->{records}) {
           next if $_ == 0;
           my $rec = $pdb->{records}->[$_];
           my $acct = $pdb->Decrypt($rec[, $password]);
           # do something with $acct
       }
   
   =head2 Password
   
       $pdb->Password([$password[, $new_password]]);
   
   Either sets the password to be used to crypt, or if you pass $new_password,
   changes the password on the database.
   
   If you have created a new $pdb, and you didn't set a password when you
   called new(), you only need to pass one password and it will set that as
   the password.
   
   If nothing is passed, it forgets the password that it was remembering.
   
   =head1 DEPENDENCIES
   
   Palm::StdAppInfo
   
   Digest::MD5
   
   Crypt::DES
   
   Readonly
   
   =head1 THANKS
   
   I would like to thank the helpful Perlmonk shigetsu who gave me some great advice
   and helped me get my first module posted.  L<http://perlmonks.org/?node_id=596998>
   
   I would also like to thank
   Johan Vromans
   E<lt>jvromans@squirrel.nlE<gt> --
   L<http://www.squirrel.nl/people/jvromans>.
   He had his own Palm::KeyRing module that he posted a couple of days before
   mine was ready and he was kind enough to let me have the namespace as well
   as giving me some very helpful hints about doing a few things that I was
   unsure of.  He is really great.
   
   =head1 BUGS AND LIMITATIONS
   
   Please report any bugs or feature requests to
   C<bug-palm-keyring at rt.cpan.org>, or through the web interface at
   L<http://rt.cpan.org>.  I will be notified, and then you'll automatically be
   notified of progress on your bug as I make changes.
   
 =head1 AUTHOR  =head1 AUTHOR
   
 Andrew Fresh E<lt>andrew@mad-techies.org<gt>  Andrew Fresh E<lt>andrew@cpan.orgE<gt>
   
   =head1 LICENSE AND COPYRIGHT
   
   Copyright 2004, 2005, 2006, 2007 Andrew Fresh, All Rights Reserved.
   
   This program is free software; you can redistribute it and/or
   modify it under the same terms as Perl itself.
   
 =head1 SEE ALSO  =head1 SEE ALSO
   
 Palm::PDB(3)  Palm::PDB(3)
   
 Palm::StdAppInfo(3)  Palm::StdAppInfo(3)
   
 =cut  The Keyring for Palm OS website:
   L<http://gnukeyring.sourceforge.net/>
   
   Johan Vromans also has a wxkeyring app that now uses this module, available
   from his website at L<http://www.vromans.org/johan/software/sw_palmkeyring.html>

Legend:
Removed from v.1.4  
changed lines
  Added in v.1.28

FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>