=================================================================== RCS file: /cvs/palm/Palm-Keyring/lib/Palm/Keyring.pm,v retrieving revision 1.29 retrieving revision 1.34 diff -u -r1.29 -r1.34 --- palm/Palm-Keyring/lib/Palm/Keyring.pm 2007/02/19 00:22:42 1.29 +++ palm/Palm-Keyring/lib/Palm/Keyring.pm 2007/02/21 05:24:14 1.34 @@ -1,5 +1,5 @@ package Palm::Keyring; -# $RedRiver: Keyring.pm,v 1.28 2007/02/18 05:50:25 andrew Exp $ +# $RedRiver: Keyring.pm,v 1.33 2007/02/21 01:26:07 andrew Exp $ ######################################################################## # Keyring.pm *** Perl class for Keyring for Palm OS databases. # @@ -16,17 +16,9 @@ use warnings; use Carp; -use Data::Dumper; use base qw/ Palm::StdAppInfo /; -use Digest::HMAC_SHA1 qw(hmac_sha1); -use Digest::SHA1 qw(sha1); -use Crypt::CBC; - -use Digest::MD5 qw(md5); -use Crypt::DES; - my $ENCRYPT = 1; my $DECRYPT = 0; my $MD5_CBLOCK = 64; @@ -36,26 +28,30 @@ my $NULL = chr 0; my @CRYPTS = ( - { # None + { + alias => 'None', name => 'None', keylen => 8, blocksize => 1, default_iter => 500, }, - { # DES-EDE3 + { + alias => 'DES-EDE3', name => 'DES_EDE3', keylen => 24, blocksize => 8, DES_odd_parity => 1, default_iter => 1000, }, - { # AES128 + { + alias => 'AES128', name => 'Rijndael', keylen => 16, blocksize => 16, default_iter => 100, }, - { # AES256 + { + alias => 'AES256', name => 'Rijndael', keylen => 32, blocksize => 16, @@ -131,6 +127,24 @@ return 1; } +# Accessors + +sub crypts +{ + my $crypt = shift; + if ($crypt =~ /\D/) { + foreach my $c (@CRYPTS) { + if ($c->{alias} eq $crypt) { + return $c; + } + } + # didn't find it. + return; + } else { + return $CRYPTS[$crypt]; + } +} + # ParseRecord sub ParseRecord @@ -154,15 +168,13 @@ } elsif ($self->{version} == 5) { my $blocksize = $CRYPTS[ $self->{appinfo}->{cipher} ]{blocksize}; my ($field, $extra) = _parse_field($rec->{data}); - my ($ivec, $encrypted) = unpack "A$blocksize A*", $extra; + my $ivec = substr $extra, 0, $blocksize; + my $encrypted = substr $extra, $blocksize; - if ($self->{options}->{v4compatible}) { - $rec->{name} = $field->{data}; - } else { - $rec->{name} = $field; - } + $rec->{name} = $field->{data}; $rec->{ivec} = $ivec; $rec->{encrypted} = $encrypted; + delete $rec->{data}; } else { die 'Unsupported Version'; @@ -190,27 +202,14 @@ } } elsif ($self->{version} == 5) { - my $field; - if ($rec->{name}) { - if ($self->{options}->{v4compatible}) { - $field = { - label => 'name', - font => 0, - data => $rec->{'name'}, - }; - } else { - $field = $rec->{name}; - } - } - my $packed = ''; - if ($field) { - $packed = _pack_field($field); - } - my $len = length $packed; - my $blocksize = $CRYPTS[ $self->{appinfo}->{cipher} ]{blocksize}; + my $field = { + 'label_id' => 1, + 'data' => $rec->{name}, + 'font' => 0, + }; + my $packed .= _pack_field($field); - $rec->{data} = pack "A$len A$blocksize A*", - $packed, $rec->{ivec}, $rec->{encrypted}; + $rec->{data} = join '', $packed, $rec->{ivec}, $rec->{encrypted}; } else { die 'Unsupported Version'; @@ -330,6 +329,7 @@ my $rec = shift; my $data = shift; my $pass = shift || $self->{password}; + my $ivec = shift; if ( ! $pass && ! $self->{appinfo}->{key}) { croak("password not set!\n"); @@ -359,31 +359,30 @@ $rec->{name} ||= $data->{name}; } elsif ($self->{version} == 5) { - my @recs = ($data, $acct); - my $name; + my @accts = ($data, $acct); if ($self->{options}->{v4compatible}) { $rec->{name} ||= $data->{name}; - foreach my $rec (@recs) { + foreach my $a (@accts) { my @fields; - foreach my $k (sort keys %{ $rec }) { + foreach my $k (sort keys %{ $a }) { my $field = { label => $k, font => 0, - data => $rec->{$k}, + data => $a->{$k}, }; push @fields, $field; } - $rec = \@fields; + $a = \@fields; } } - my $ivec; ($encrypted, $ivec) = _encrypt_v5( - @recs, + @accts, $self->{appinfo}->{key}, $self->{appinfo}->{cipher}, + $ivec, ); - if ($ivec) { + if (defined $ivec) { $rec->{ivec} = $ivec; } @@ -408,6 +407,8 @@ sub _encrypt_v4 { + require Crypt::CBC; + my $new = shift; my $old = shift; my $digest = shift; @@ -481,11 +482,15 @@ my $old = shift; my $key = shift; my $cipher = shift; - my $ivec = shift || pack("C*",map {rand(256)} 1..8); - + my $ivec = shift; + my $blocksize = $CRYPTS[ $cipher ]{blocksize}; my $keylen = $CRYPTS[ $cipher ]{keylen}; my $cipher_name = $CRYPTS[ $cipher ]{name}; + if (! defined $ivec) { + $ivec = pack("C*",map {rand(256)} 1..$blocksize); + } + my $changed = 0; my $need_newdate = 1; my $date_index; @@ -548,7 +553,6 @@ foreach my $field (@{ $new }) { $decrypted .= _pack_field($field); } - my $encrypted; if ($cipher_name eq 'None') { # do nothing @@ -561,6 +565,7 @@ -iv => $ivec, -cipher => $cipher_name, -keysize => $keylen, + -blocksize => $blocksize, -header => 'none', -padding => 'oneandzeroes', ); @@ -580,7 +585,7 @@ # Decrypt -sub Decrypt +sub Decrypt { my $self = shift; my $rec = shift; @@ -594,7 +599,7 @@ croak("Needed parameter 'record' not passed!\n"); } - if ( ! $self->Password($pass)) { + if ( $pass && ! $self->Password($pass)) { croak("Invalid Password!\n"); } @@ -654,6 +659,8 @@ sub _decrypt_v5 { + require Crypt::CBC; + my $encrypted = shift; my $key = shift; my $cipher = shift; @@ -661,6 +668,7 @@ my $keylen = $CRYPTS[ $cipher ]{keylen}; my $cipher_name = $CRYPTS[ $cipher ]{name}; + my $blocksize = $CRYPTS[ $cipher ]{blocksize}; my $decrypted; @@ -675,6 +683,7 @@ -iv => $ivec, -cipher => $cipher_name, -keysize => $keylen, + -blocksize => $blocksize, -header => 'none', -padding => 'oneandzeroes', ); @@ -682,7 +691,8 @@ if (! $c) { croak("Unable to set up encryption!"); } - $encrypted .= $NULL x $keylen; # pad out a keylen + my $len = $blocksize - length($encrypted) % $blocksize; + $encrypted .= $NULL x $len; $decrypted = $c->decrypt($encrypted); } else { @@ -713,7 +723,7 @@ if (! $pass) { delete $self->{password}; - delete $self->{key}; + delete $self->{appinfo}->{key}; return 1; } @@ -791,6 +801,9 @@ sub _password_verify_v4 { + require Digest::MD5; + import Digest::MD5 qw(md5); + my $pass = shift; my $data = shift; @@ -808,7 +821,7 @@ my $digest = md5($msg); - if (! $data eq $salt . $digest ) { + if ($data ne $salt . $digest ) { return; } @@ -891,6 +904,9 @@ sub _password_update_v4 { + require Digest::MD5; + import Digest::MD5 qw(md5); + my $pass = shift; if (! defined $pass) { croak('No password specified!'); }; @@ -939,6 +955,7 @@ return $key; } +# Helpers sub _calc_keys { @@ -968,6 +985,11 @@ { my ($pass, $salt, $iter, $keylen, $dop) = @_; + require Digest::HMAC_SHA1; + import Digest::HMAC_SHA1 qw(hmac_sha1); + require Digest::SHA1; + import Digest::SHA1 qw(sha1); + my $key = _pbkdf2( $pass, $salt, $iter, $keylen, \&hmac_sha1 ); if ($dop) { $key = DES_odd_parity($key); } @@ -978,6 +1000,8 @@ sub _crypt3des { + require Crypt::DES; + my ( $plaintext, $passphrase, $flag ) = @_; $passphrase .= $SPACE x ( 16 * 3 ); @@ -1040,15 +1064,16 @@ if ($len + 4 > length $field) { return undef, $field; } - my $unpackstr = "S1 C1 C1 A$len"; - if ($len % 2) { + my $unpackstr = "x2 C1 C1 A$len"; + my $offset = 2 +1 +1 +$len; + if ($len % 2) { # && $len + 4 < length $field) { # trim the 0/1 byte padding for next even address. + $offset++; $unpackstr .= ' x' } - $unpackstr .= ' A*'; - my (undef, $label, $font, $data, $leftover) - = unpack $unpackstr, $field; + my ($label, $font, $data) = unpack $unpackstr, $field; + my $leftover = substr $field, $offset; if ($label == 3) { $data = _parse_keyring_date($data); @@ -1227,7 +1252,6 @@ 1; __END__ - =head1 NAME Palm::Keyring - Handler for Palm Keyring databases. @@ -1241,8 +1265,9 @@ It has the standard Palm::PDB methods with 2 additional public methods. Decrypt and Encrypt. -It currently supports the v4 Keyring databases. The v5 databases from -the pre-release keyring-2.0 are not supported. +It currently supports the v4 Keyring databases. +The pre-release v5 databases are mostly supported. There are definitely some +bugs, For example, t/keyring5.t sometimes fails. I am not sure why yet. This module doesn't store the decrypted content. It only keeps it until it returns it to you or encrypts it. @@ -1258,7 +1283,8 @@ $pdb->Load($file); foreach (0..$#{ $pdb->{records} }) { - next if $_ = 0; # skip the password record + # skip the password record for version 4 databases + next if $_ == 0 && $pdb->{version} == 4; my $rec = $pdb->{records}->[$_]; my $acct = $pdb->Decrypt($rec, $pass); print $rec->{name}, ' - ', $acct->{account}, "\n"; @@ -1268,7 +1294,7 @@ =head2 new - $pdb = new Palm::Keyring([$password]); + $pdb = new Palm::Keyring([$password[, $version]]); Create a new PDB, initialized with the various Palm::Keyring fields and an empty record list. @@ -1279,17 +1305,77 @@ If you pass in a password, it will initalize the first record with the encrypted password. +new() now also takes options in other formats + + $pdb = new Palm::Keyring({ key1 => value1, key2 => value2 }); + $pdb = new Palm::Keyring( -key1 => value1, -key2 => value2); + +=head3 Supported options are: + +=over + +=item password + +The password used to initialize the database + +=item version + +The version of database to create. Accepts either 4 or 5. Currently defaults to 4. + +=item v4compatible + +The format of the fields passed to Encrypt and returned from Decrypt have changed. +This allows programs to use the newer databases with few changes but with less features. + +=item cipher + +The cipher to use. 0, 1, 2 or 3. + + 0 => None + 1 => DES_EDE3 + 2 => AES128 + 3 => AES256 + +=item iterations + +The number of iterations to encrypt with. + +=back + +=head2 crypt + +Pass in the alias of the crypt to use, or the index. + +This is a function, not a method. + + my $c = Palm::Keyring::crypt($cipher); + +$c is now: + + $c = { + alias => (None|DES_EDE3|AES128|AES256), + name => (None|DES_EDE3|Rijndael), + keylen => , + blocksize => , + default_iter => , + }; + + =head2 Encrypt - $pdb->Encrypt($rec, $acct[, $password]); + $pdb->Encrypt($rec, $acct[, $password[, $ivec]]); Encrypts an account into a record, either with the password previously used, or with a password that is passed. +$ivec is the initialization vector to use to encrypt the record. This is +not used by v4 databases. Normally this is not passed and is generated +randomly. + $rec is a record from $pdb->{records} or a new_Record(). -$acct is a hashref in the format below. +The v4 $acct is a hashref in the format below. - my $acct = { + my $v4acct = { name => $rec->{name}, account => $account, password => $password, @@ -1301,6 +1387,39 @@ }, }; +The v5 $acct is an arrayref full of hashrefs that contain each encrypted field. + + my $v5acct = [ + { + 'label_id' => 2, + 'data' => 'abcd1234', + 'label' => 'password', + 'font' => 0 + }, + { + 'label_id' => 3, + 'data' => { + 'month' => 1, + 'day' => 11, + 'year' => 107 + }, + 'label' => 'lastchange', + 'font' => 0 + }, + { + 'label_id' => 255, + 'data' => 'This is a short note.', + 'label' => 'notes', + 'font' => 0 + } + ]; + + +The account name is stored in $rec->{name} for both v4 and v5 databases. +It is not returned in the decrypted information for v5. + + $rec->{name} = 'account name'; + If you have changed anything other than the lastchange, or don't pass in a lastchange key, Encrypt() will generate a new lastchange date for you. @@ -1313,16 +1432,17 @@ my $acct = $pdb->Decrypt($rec[, $password]); -Decrypts the record and returns a hashref for the account as described +Decrypts the record and returns a reference for the account as described under Encrypt(). foreach (0..$#{ $pdb->{records}) { - next if $_ == 0; + next if $_ == 0 && $pdb->{version} == 4; my $rec = $pdb->{records}->[$_]; - my $acct = $pdb->Decrypt($rec[, $password]); + my $acct = $pdb->Decrypt($rec); # do something with $acct } + =head2 Password $pdb->Password([$password[, $new_password]]); @@ -1386,6 +1506,9 @@ The Keyring for Palm OS website: L + +The HACKING guide for palm keyring databases: +L Johan Vromans also has a wxkeyring app that now uses this module, available from his website at L