===================================================================
RCS file: /cvs/palm/Palm-Keyring/lib/Palm/Keyring.pm,v
retrieving revision 1.31
retrieving revision 1.35
diff -u -r1.31 -r1.35
--- palm/Palm-Keyring/lib/Palm/Keyring.pm	2007/02/19 02:55:35	1.31
+++ palm/Palm-Keyring/lib/Palm/Keyring.pm	2007/02/22 04:11:35	1.35
@@ -1,5 +1,5 @@
 package Palm::Keyring;
-# $RedRiver: Keyring.pm,v 1.30 2007/02/19 01:37:10 andrew Exp $
+# $RedRiver: Keyring.pm,v 1.34 2007/02/21 05:24:14 andrew Exp $
 ########################################################################
 # Keyring.pm *** Perl class for Keyring for Palm OS databases.
 #
@@ -16,17 +16,10 @@
 use warnings;
 
 use Carp;
-use Data::Dumper;
+$Carp::Verbose = 1;
 
 use base qw/ Palm::StdAppInfo /;
 
-use Digest::HMAC_SHA1 qw(hmac_sha1);
-use Digest::SHA1 qw(sha1);
-use Crypt::CBC;
-
-use Digest::MD5 qw(md5);
-use Crypt::DES;
-
 my $ENCRYPT    = 1;
 my $DECRYPT    = 0;
 my $MD5_CBLOCK = 64;
@@ -36,26 +29,30 @@
 my $NULL       = chr 0;
 
 my @CRYPTS = (
-    { # None
+    { 
+        alias     => 'None',
         name      => 'None',
         keylen    => 8,
         blocksize => 1,
         default_iter => 500,
     },
-    { # DES-EDE3
+    { 
+        alias     => 'DES-EDE3',
         name      => 'DES_EDE3',
         keylen    => 24,
         blocksize =>  8,
         DES_odd_parity => 1,
         default_iter => 1000,
     },
-    { # AES128
+    {   
+        alias     => 'AES128',
         name      => 'Rijndael',
         keylen    => 16,
         blocksize => 16,
         default_iter => 100,
     },
-    { # AES256
+    { 
+        alias     => 'AES256',
         name      => 'Rijndael',
         keylen    => 32,
         blocksize => 16,
@@ -131,6 +128,24 @@
     return 1;
 }
 
+# Accessors
+
+sub crypts
+{
+    my $crypt = shift;
+    if ($crypt =~ /\D/) {
+        foreach my $c (@CRYPTS) {
+            if ($c->{alias} eq $crypt) {
+                return $c;
+            }
+        }
+        # didn't find it.
+        return;
+    } else {
+        return $CRYPTS[$crypt];
+    }
+}
+
 # ParseRecord
 
 sub ParseRecord 
@@ -160,6 +175,7 @@
         $rec->{name}      = $field->{data};
         $rec->{ivec}      = $ivec;
         $rec->{encrypted} = $encrypted;
+        delete $rec->{data};
 
     } else {
         die 'Unsupported Version';
@@ -247,7 +263,7 @@
 
     my $unpackstr
         = ("C1" x 8)  # 8 uint8s in an array for the salt
-        . ("S1" x 2)  # the iter (uint16) and the cipher (uint16)
+        . ("n1" x 2)  # the iter (uint16) and the cipher (uint16)
         . ("C1" x 8); # and finally 8 more uint8s for the hash
 
     my (@salt, $iter, $cipher, @hash);
@@ -288,7 +304,7 @@
 
     my $packstr
         = ("C1" x 8)  # 8 uint8s in an array for the salt
-        . ("S1" x 2)  # the iter (uint16) and the cipher (uint16)
+        . ("n1" x 2)  # the iter (uint16) and the cipher (uint16)
         . ("C1" x 8); # and finally 8 more uint8s for the hash
 
     my @salt = map { hex $_ } $appinfo->{salt} =~ /../gxm;
@@ -314,6 +330,7 @@
     my $rec  = shift;
     my $data = shift;
     my $pass = shift || $self->{password};
+    my $ivec = shift;
 
     if ( ! $pass && ! $self->{appinfo}->{key}) {
         croak("password not set!\n");
@@ -343,31 +360,30 @@
         $rec->{name}    ||= $data->{name};
 
     } elsif ($self->{version} == 5) {
-        my @recs = ($data, $acct);
-        my $name;
+        my @accts = ($data, $acct);
         if ($self->{options}->{v4compatible}) {
             $rec->{name} ||= $data->{name};
-            foreach my $rec (@recs) {
+            foreach my $a (@accts) {
                 my @fields;
-                foreach my $k (sort keys %{ $rec }) {
+                foreach my $k (sort keys %{ $a }) {
                     my $field = {
                         label    => $k,
                         font     => 0,
-                        data     => $rec->{$k},
+                        data     => $a->{$k},
                     };
                     push @fields, $field;
                 }
-                $rec = \@fields;
+                $a = \@fields;
             }
         }
 
-        my $ivec;
         ($encrypted, $ivec) = _encrypt_v5(
-            @recs,
+            @accts,
             $self->{appinfo}->{key}, 
             $self->{appinfo}->{cipher},
+            $ivec,
         );
-        if ($ivec) {
+        if (defined $ivec) {
             $rec->{ivec} = $ivec;
         }
 
@@ -465,12 +481,15 @@
     my $old    = shift;
     my $key    = shift;
     my $cipher = shift;
-    my $length = $CRYPTS[ $cipher ]{blocksize};
-    my $ivec   = shift || pack("C*",map {rand(256)} 1..$length);
-
+    my $ivec   = shift;
+    my $blocksize   = $CRYPTS[ $cipher ]{blocksize};
     my $keylen      = $CRYPTS[ $cipher ]{keylen}; 
     my $cipher_name = $CRYPTS[ $cipher ]{name};
 
+    if (! defined $ivec) { 
+        $ivec = pack("C*",map {rand(256)} 1..$blocksize);
+    }
+
     my $changed = 0;
     my $need_newdate = 1;
     my $date_index;
@@ -533,19 +552,20 @@
     foreach my $field (@{ $new }) {
         $decrypted .= _pack_field($field);
     }
-
     my $encrypted;
     if ($cipher_name eq 'None') {
         # do nothing
         $encrypted = $decrypted;
 
     } elsif ($cipher_name eq 'DES_EDE3' or $cipher_name eq 'Rijndael') {
+        require Crypt::CBC;
         my $c = Crypt::CBC->new( 
-            -literal_key => 1,
             -key         => $key,
+            -literal_key => 1,
             -iv          => $ivec,
             -cipher      => $cipher_name,
             -keysize     => $keylen,
+            -blocksize   => $blocksize,
             -header      => 'none',
             -padding     => 'oneandzeroes',
         );
@@ -639,6 +659,7 @@
 
 sub _decrypt_v5
 {
+
     my $encrypted = shift;
     my $key       = shift;
     my $cipher    = shift;
@@ -646,6 +667,7 @@
 
     my $keylen       = $CRYPTS[ $cipher ]{keylen};
     my $cipher_name  = $CRYPTS[ $cipher ]{name};
+    my $blocksize    = $CRYPTS[ $cipher ]{blocksize};
 
     my $decrypted;
 
@@ -654,12 +676,14 @@
         $decrypted = $encrypted;
 
     } elsif ($cipher_name eq 'DES_EDE3' or $cipher_name eq 'Rijndael') {
+        require Crypt::CBC;
         my $c = Crypt::CBC->new( 
-            -literal_key => 1,
             -key         => $key,
+            -literal_key => 1,
             -iv          => $ivec,
             -cipher      => $cipher_name,
             -keysize     => $keylen,
+            -blocksize   => $blocksize,
             -header      => 'none',
             -padding     => 'oneandzeroes',
         );
@@ -667,7 +691,8 @@
         if (! $c) {
             croak("Unable to set up encryption!");
         }
-        $encrypted .= $NULL x $keylen; # pad out a keylen
+        my $len = $blocksize - length($encrypted) % $blocksize;
+        $encrypted .= $NULL x $len;
         $decrypted  = $c->decrypt($encrypted);
 
     } else {
@@ -766,7 +791,7 @@
             }
         }
     } elsif ($self->{version} == 5) {
-        return _password_verify_v5($pass, $self->{appinfo});
+        return _password_verify_v5($self->{appinfo}, $pass);
     } else {
         # XXX unsupported version
     }
@@ -776,6 +801,9 @@
 
 sub _password_verify_v4 
 {
+    require Digest::MD5;
+    import Digest::MD5 qw(md5);
+
     my $pass = shift;
     my $data = shift;
 
@@ -793,7 +821,7 @@
 
     my $digest = md5($msg);
 
-    if (! $data eq $salt . $digest ) {
+    if ($data ne $salt . $digest ) {
         return;
     }
 
@@ -802,8 +830,8 @@
 
 sub _password_verify_v5 
 {
-    my $pass    = shift;
     my $appinfo = shift;
+    my $pass    = shift;
 
     my $salt = pack("H*", $appinfo->{salt});
 
@@ -813,7 +841,9 @@
         $CRYPTS[ $appinfo->{cipher} ]{DES_odd_parity}, 
     );
 
+    #print "Iter: '" . $appinfo->{iter} . "'\n";
     #print "Key:  '". unpack("H*", $key) . "'\n";
+    #print "Salt: '". unpack("H*", $salt) . "'\n";
     #print "Hash: '". $hash . "'\n";
     #print "Hash: '". $appinfo->{masterhash} . "'\n";
 
@@ -876,6 +906,9 @@
 
 sub _password_update_v4
 {
+    require Digest::MD5;
+    import Digest::MD5 qw(md5);
+
     my $pass = shift;
     
     if (! defined $pass) { croak('No password specified!'); };
@@ -924,6 +957,7 @@
     return $key;
 }
 
+# Helpers
 
 sub _calc_keys 
 {
@@ -953,6 +987,11 @@
 {
     my ($pass, $salt, $iter, $keylen, $dop) = @_;
 
+    require Digest::HMAC_SHA1;
+    import  Digest::HMAC_SHA1 qw(hmac_sha1);
+    require Digest::SHA1;
+    import  Digest::SHA1 qw(sha1);
+
     my $key = _pbkdf2( $pass, $salt, $iter, $keylen, \&hmac_sha1 );
     if ($dop) { $key = DES_odd_parity($key); }
 
@@ -963,6 +1002,8 @@
 
 sub _crypt3des 
 {
+    require Crypt::DES;
+
     my ( $plaintext, $passphrase, $flag ) = @_;
 
     $passphrase   .= $SPACE x ( 16 * 3 );
@@ -1021,19 +1062,20 @@
     $labels[3]   = 'lastchange';
     $labels[255] = 'notes';
 
-    my ($len) = unpack "S1", $field;
+    my ($len) = unpack "n1", $field;
     if ($len + 4 > length $field) {
         return undef, $field;
     }
-    my $unpackstr = "S1 C1 C1 A$len";
-    if ($len % 2 && $len + 4 < length $field) {
+    my $unpackstr = "x2 C1 C1 A$len";
+    my $offset    =   2 +1 +1 +$len;
+    if ($len % 2) { # && $len + 4 < length $field) {
         # trim the 0/1 byte padding for next even address.
+        $offset++;
         $unpackstr .= ' x' 
     }
-    $unpackstr .= ' A*';
 
-    my (undef, $label, $font, $data, $leftover) 
-        = unpack $unpackstr, $field;
+    my ($label, $font, $data) = unpack $unpackstr, $field;
+    my $leftover = substr $field, $offset;
 
     if ($label == 3) {
         $data = _parse_keyring_date($data);
@@ -1067,7 +1109,7 @@
         $data = _pack_keyring_date($data);
     }
     my $len = length $data;
-    my $packstr = "S1 C1 C1 A*";
+    my $packstr = "n1 C1 C1 A*";
 
     my $packed = pack $packstr, ($len, $label, $font, $data);
 
@@ -1302,12 +1344,35 @@
 
 =back
 
+=head2 crypt
+
+Pass in the alias of the crypt to use, or the index.
+
+This is a function, not a method.  
+
+    my $c = Palm::Keyring::crypt($cipher);
+
+$c is now:
+
+    $c = {
+        alias     => (None|DES_EDE3|AES128|AES256),
+        name      => (None|DES_EDE3|Rijndael),
+        keylen    => <key length of the ciphe>,
+        blocksize => <block size of the cipher>,
+        default_iter => <default iterations for the cipher>,
+    };
+
+
 =head2 Encrypt
 
-    $pdb->Encrypt($rec, $acct[, $password]);
+    $pdb->Encrypt($rec, $acct[, $password[, $ivec]]);
 
 Encrypts an account into a record, either with the password previously 
 used, or with a password that is passed.
+
+$ivec is the initialization vector to use to encrypt the record.  This is
+not used by v4 databases.  Normally this is not passed and is generated 
+randomly.
 
 $rec is a record from $pdb->{records} or a new_Record().
 The v4 $acct is a hashref in the format below.