version 1.38, 2007/02/23 02:54:49 |
version 1.43, 2007/02/23 22:05:17 |
|
|
package Palm::Keyring; |
package Palm::Keyring; |
# $RedRiver: Keyring.pm,v 1.37 2007/02/23 02:34:01 andrew Exp $ |
# $RedRiver: Keyring.pm,v 1.42 2007/02/23 03:41:28 andrew Exp $ |
######################################################################## |
######################################################################## |
# Keyring.pm *** Perl class for Keyring for Palm OS databases. |
# Keyring.pm *** Perl class for Keyring for Palm OS databases. |
# |
# |
|
|
# Set defaults |
# Set defaults |
if ($self->{version} == 5) { |
if ($self->{version} == 5) { |
$self->{options}->{cipher} ||= 0; # 'None' |
$self->{options}->{cipher} ||= 0; # 'None' |
$self->{options}->{iterations} ||= |
my $c = crypts($self->{options}->{cipher}) |
$CRYPTS[ $self->{options}->{cipher} ]{default_iter}; |
or croak('Unknown cipher ' . $self->{options}->{cipher}); |
|
$self->{options}->{iterations} ||= $c->{default_iter}; |
$self->{appinfo}->{cipher} ||= $self->{options}->{cipher}; |
$self->{appinfo}->{cipher} ||= $self->{options}->{cipher}; |
$self->{appinfo}->{iter} ||= $self->{options}->{iterations}; |
$self->{appinfo}->{iter} ||= $self->{options}->{iterations}; |
}; |
}; |
|
|
if ( defined $options->{password} ) { |
if ( defined $options->{password} ) { |
|
|
sub crypts |
sub crypts |
{ |
{ |
my $crypt = shift; |
my $crypt = shift; |
if ($crypt =~ /\D/) { |
if (! defined $crypt || ! length $crypt) { |
|
return; |
|
} elsif ($crypt =~ /\D/) { |
foreach my $c (@CRYPTS) { |
foreach my $c (@CRYPTS) { |
if ($c->{alias} eq $crypt) { |
if ($c->{alias} eq $crypt) { |
return $c; |
return $c; |
|
|
delete $rec->{data}; |
delete $rec->{data}; |
|
|
} elsif ($self->{version} == 5) { |
} elsif ($self->{version} == 5) { |
my $blocksize = $CRYPTS[ $self->{appinfo}->{cipher} ]{blocksize}; |
my $c = crypts( $self->{appinfo}->{cipher} ) |
|
or croak('Unknown cipher ' . $self->{appinfo}->{cipher}); |
|
my $blocksize = $c->{blocksize}; |
my ($field, $extra) = _parse_field($rec->{data}); |
my ($field, $extra) = _parse_field($rec->{data}); |
delete $rec->{data}; |
delete $rec->{data}; |
|
|
|
|
my $key = shift; |
my $key = shift; |
my $cipher = shift; |
my $cipher = shift; |
my $ivec = shift; |
my $ivec = shift; |
my $blocksize = $CRYPTS[ $cipher ]{blocksize}; |
my $c = crypts($cipher) or croak('Unknown cipher ' . $cipher); |
my $keylen = $CRYPTS[ $cipher ]{keylen}; |
|
my $cipher_name = $CRYPTS[ $cipher ]{name}; |
|
|
|
if (! defined $ivec) { |
if (! defined $ivec) { |
$ivec = pack("C*",map {rand(256)} 1..$blocksize); |
$ivec = pack("C*",map {rand(256)} 1..$c->{blocksize}); |
} |
} |
|
|
my $changed = 0; |
my $changed = 0; |
|
|
$decrypted .= _pack_field($field); |
$decrypted .= _pack_field($field); |
} |
} |
my $encrypted; |
my $encrypted; |
if ($cipher_name eq 'None') { |
if ($c->{name} eq 'None') { |
# do nothing |
# do nothing |
$encrypted = $decrypted; |
$encrypted = $decrypted; |
|
|
} elsif ($cipher_name eq 'DES_EDE3' or $cipher_name eq 'Rijndael') { |
} elsif ($c->{name} eq 'DES_EDE3' or $c->{name} eq 'Rijndael') { |
require Crypt::CBC; |
require Crypt::CBC; |
my $c = Crypt::CBC->new( |
my $cbc = Crypt::CBC->new( |
-key => $key, |
-key => $key, |
-literal_key => 1, |
-literal_key => 1, |
-iv => $ivec, |
-iv => $ivec, |
-cipher => $cipher_name, |
-cipher => $c->{name}, |
-keysize => $keylen, |
-keysize => $c->{keylen}, |
-blocksize => $blocksize, |
-blocksize => $c->{blocksize}, |
-header => 'none', |
-header => 'none', |
-padding => 'oneandzeroes', |
-padding => 'oneandzeroes', |
); |
); |
|
|
croak("Unable to set up encryption!"); |
croak("Unable to set up encryption!"); |
} |
} |
|
|
$encrypted = $c->encrypt($decrypted); |
$encrypted = $cbc->encrypt($decrypted); |
|
|
} else { |
} else { |
die "Unsupported Version"; |
die "Unsupported Version"; |
|
|
my $cipher = shift; |
my $cipher = shift; |
my $ivec = shift; |
my $ivec = shift; |
|
|
my $keylen = $CRYPTS[ $cipher ]{keylen}; |
my $c = crypts($cipher) or croak('Unknown cipher ' . $cipher); |
my $cipher_name = $CRYPTS[ $cipher ]{name}; |
|
my $blocksize = $CRYPTS[ $cipher ]{blocksize}; |
|
|
|
my $decrypted; |
my $decrypted; |
|
|
if ($cipher_name eq 'None') { |
if ($c->{name} eq 'None') { |
# do nothing |
# do nothing |
$decrypted = $encrypted; |
$decrypted = $encrypted; |
|
|
} elsif ($cipher_name eq 'DES_EDE3' or $cipher_name eq 'Rijndael') { |
} elsif ($c->{name} eq 'DES_EDE3' or $c->{name} eq 'Rijndael') { |
require Crypt::CBC; |
require Crypt::CBC; |
my $c = Crypt::CBC->new( |
my $cbc = Crypt::CBC->new( |
-key => $key, |
-key => $key, |
-literal_key => 1, |
-literal_key => 1, |
-iv => $ivec, |
-iv => $ivec, |
-cipher => $cipher_name, |
-cipher => $c->{name}, |
-keysize => $keylen, |
-keysize => $c->{keylen}, |
-blocksize => $blocksize, |
-blocksize => $c->{blocksize}, |
-header => 'none', |
-header => 'none', |
-padding => 'oneandzeroes', |
-padding => 'oneandzeroes', |
); |
); |
|
|
if (! $c) { |
if (! $c) { |
croak("Unable to set up encryption!"); |
croak("Unable to set up encryption!"); |
} |
} |
my $len = $blocksize - length($encrypted) % $blocksize; |
my $len = $c->{blocksize} - length($encrypted) % $c->{blocksize}; |
$encrypted .= $NULL x $len; |
$encrypted .= $NULL x $len; |
$decrypted = $c->decrypt($encrypted); |
$decrypted = $cbc->decrypt($encrypted); |
|
|
} else { |
} else { |
die "Unsupported Version"; |
die "Unsupported Version"; |
|
|
|
|
my $salt = pack("H*", $appinfo->{salt}); |
my $salt = pack("H*", $appinfo->{salt}); |
|
|
|
my $c = crypts($appinfo->{cipher}) |
|
or croak('Unknown cipher ' . $appinfo->{cipher}); |
my ($key, $hash) = _calc_key_v5( |
my ($key, $hash) = _calc_key_v5( |
$pass, $salt, $appinfo->{iter}, |
$pass, $salt, $appinfo->{iter}, |
$CRYPTS[ $appinfo->{cipher} ]{keylen}, |
$c->{keylen}, |
$CRYPTS[ $appinfo->{cipher} ]{DES_odd_parity}, |
$c->{DES_odd_parity}, |
); |
); |
|
|
#print "Iter: '" . $appinfo->{iter} . "'\n"; |
#print "Iter: '" . $appinfo->{iter} . "'\n"; |
|
|
my $length = 8; |
my $length = 8; |
my $salt = shift || pack("C*",map {rand(256)} 1..$length); |
my $salt = shift || pack("C*",map {rand(256)} 1..$length); |
|
|
|
my $c = crypts($cipher) or croak('Unknown cipher ' . $cipher); |
my ($key, $hash) = _calc_key_v5( |
my ($key, $hash) = _calc_key_v5( |
$pass, $salt, $iter, |
$pass, $salt, $iter, |
$CRYPTS[ $cipher ]->{keylen}, |
$c->{keylen}, |
$CRYPTS[ $cipher ]->{DES_odd_parity}, |
$c->{DES_odd_parity}, |
); |
); |
|
|
$appinfo->{salt} = unpack "H*", $salt; |
$appinfo->{salt} = unpack "H*", $salt; |
$appinfo->{iter} = $iter; |
$appinfo->{iter} = $iter; |
$appinfo->{cipher} = $cipher; |
$appinfo->{cipher} = $cipher; |
|
|
$appinfo->{key} = $key; |
|
$appinfo->{masterhash} = $hash; |
$appinfo->{masterhash} = $hash; |
|
$appinfo->{key} = $key; |
|
|
return $key; |
return $key; |
} |
} |
|
|
import Digest::SHA1 qw(sha1); |
import Digest::SHA1 qw(sha1); |
|
|
my $key = _pbkdf2( $pass, $salt, $iter, $keylen, \&hmac_sha1 ); |
my $key = _pbkdf2( $pass, $salt, $iter, $keylen, \&hmac_sha1 ); |
if ($dop) { $key = DES_odd_parity($key); } |
if ($dop) { $key = _DES_odd_parity($key); } |
|
|
my $hash = unpack("H*", substr(sha1($key.$salt),0, 8)); |
my $hash = unpack("H*", substr(sha1($key.$salt),0, 8)); |
|
|
|
|
return substr($t, 0, $keylen); |
return substr($t, 0, $keylen); |
} |
} |
|
|
sub DES_odd_parity($) { |
sub _DES_odd_parity($) { |
my $key = $_[0]; |
my $key = $_[0]; |
my ($r, $i); |
my ($r, $i); |
my @odd_parity = ( |
my @odd_parity = ( |
|
|
|
|
It currently supports the v4 Keyring databases as well as |
It currently supports the v4 Keyring databases as well as |
the pre-release v5 databases. I am not completely happy with the interface |
the pre-release v5 databases. I am not completely happy with the interface |
for accessing the v5 database, so any suggestions on improvements on |
for accessing v5 databases, so any suggestions on improvements on |
the interface are appreciated. |
the interface are appreciated. |
|
|
This module doesn't store the decrypted content. It only keeps it until it |
This module doesn't store the decrypted content. It only keeps it until it |
|
|
|
|
=item cipher |
=item cipher |
|
|
The cipher to use. 0, 1, 2 or 3. |
The cipher to use. Either the number or the name. |
|
|
0 => None |
0 => None |
1 => DES_EDE3 |
1 => DES_EDE3 |
|
|
=back |
=back |
|
|
For v5 databases there are some additional appinfo fields set. |
For v5 databases there are some additional appinfo fields set. |
|
These are set either on new() or Load(). |
|
|
$pdb->{appinfo} = { |
$pdb->{appinfo} = { |
# normal appinfo stuff described in L<Palm::StdAppInfo> |
# normal appinfo stuff described in L<Palm::StdAppInfo> |
|
|
iter => Number of iterations for the cipher |
iter => Number of iterations for the cipher |
}; |
}; |
|
|
=head2 crypt |
=head2 crypts |
|
|
Pass in the alias of the crypt to use, or the index. |
Pass in the alias of the crypt to use, or the index. |
|
|
These only make sense for v5 databases. |
These only make sense for v5 databases. |
|
|
This is a function, not a method. |
This is a function, not a method. |
|
|
$cipher can be 0, 1, 2, 3, None, DES_EDE3, AES128 or AES256. |
$cipher can be 0, 1, 2, 3, None, DES_EDE3, AES128 or AES256. |
|
|
my $c = Palm::Keyring::crypt($cipher); |
my $c = Palm::Keyring::crypt($cipher); |
|
|
Decrypts the record and returns a reference for the account as described |
Decrypts the record and returns a reference for the account as described |
under Encrypt(). |
under Encrypt(). |
|
|
foreach (0..$#{ $pdb->{records}) { |
foreach (0..$#{ $pdb->{records} }) { |
next if $_ == 0 && $pdb->{version} == 4; |
next if $_ == 0 && $pdb->{version} == 4; |
my $rec = $pdb->{records}->[$_]; |
my $rec = $pdb->{records}->[$_]; |
my $acct = $pdb->Decrypt($rec); |
my $acct = $pdb->Decrypt($rec); |
|
|
or calculated when setting a new password. |
or calculated when setting a new password. |
}; |
}; |
|
|
|
=head2 Other overridden subroutines/methods |
|
|
|
=over |
|
|
|
=item ParseAppInfoBlock |
|
|
|
Converts the extra returned by Palm::StdAppInfo::ParseAppInfoBlock() into |
|
the following additions to $pdb->{appinfo} |
|
|
|
$pdb->{appinfo} = { |
|
cipher => The index number of the cipher being used (Not v4) |
|
iter => Number of iterations for the cipher (Not v4) |
|
}; |
|
|
|
=item PackAppInfoBlock |
|
|
|
Reverses ParseAppInfoBlock before |
|
sending it on to Palm::StdAppInfo::PackAppInfoBlock() |
|
|
|
=item ParseRecord |
|
|
|
Adds some fields to a record from Palm::StdAppInfo::ParseRecord() |
|
|
|
$rec = { |
|
name => Account name |
|
ivec => The IV for the encrypted record. (Not v4) |
|
encrypted => the encrypted information |
|
}; |
|
|
|
=item PackRecord |
|
|
|
Reverses ParseRecord and then sends it through Palm::StdAppInfo::PackRecord() |
|
|
|
=back |
|
|
=head1 DEPENDENCIES |
=head1 DEPENDENCIES |
|
|
Palm::StdAppInfo |
Palm::StdAppInfo |
|
|
|
B<For v4 databases> |
|
|
Digest::MD5 |
Digest::MD5 |
|
|
Crypt::DES |
Crypt::DES |
|
|
Readonly |
B<For v5 databases> |
|
|
|
Digest::HMAC_SHA1 |
|
|
|
Digest::SHA1 |
|
|
|
Depending on how the database is encrypted |
|
|
|
Crypt::CBC - For any encryption but None |
|
|
|
Crypt::DES_EDE3 - DES_EDE3 encryption |
|
|
|
Crytp::Rijndael - AES encryption schemes |
|
|
=head1 THANKS |
=head1 THANKS |
|
|
I would like to thank the helpful Perlmonk shigetsu who gave me some great advice |
I would like to thank the helpful Perlmonk shigetsu who gave me some great advice |
|
|
as giving me some very helpful hints about doing a few things that I was |
as giving me some very helpful hints about doing a few things that I was |
unsure of. He is really great. |
unsure of. He is really great. |
|
|
|
And finally, |
|
thanks to Jochen Hoenicke E<lt>hoenicke@gmail.comE<gt> |
|
(one of the authors of Palm Keyring) |
|
for getting me started on the v5 support as well as providing help |
|
and some subroutines. |
|
|
=head1 BUGS AND LIMITATIONS |
=head1 BUGS AND LIMITATIONS |
|
|
|
I am sure there are problems with this module. For example, I have |
|
not done very extensive testing of the v5 databases. |
|
|
|
I am not very happy with the data structures used by Encrypt() and |
|
Decrypt() for v5 databases, but I am not sure of a better way. |
|
|
|
The v4 compatibility mode does not insert a fake record 0 where |
|
normally the encrypted password is stored. |
|
|
|
The date validation for packing new dates is very poor. |
|
|
|
I have not gone through and standardized on how the module fails. Some |
|
things fail with croak, some return undef, some may even fail silently. |
|
Nothing initializes a lasterr method or anything like that. I need |
|
to fix all that before it is a 1.0 candidate. |
|
|
Please report any bugs or feature requests to |
Please report any bugs or feature requests to |
C<bug-palm-keyring at rt.cpan.org>, or through the web interface at |
C<bug-palm-keyring at rt.cpan.org>, or through the web interface at |