=================================================================== RCS file: /cvs/palm/Palm-Keyring/lib/Palm/Keyring.pm,v retrieving revision 1.33 retrieving revision 1.36 diff -u -r1.33 -r1.36 --- palm/Palm-Keyring/lib/Palm/Keyring.pm 2007/02/21 01:26:07 1.33 +++ palm/Palm-Keyring/lib/Palm/Keyring.pm 2007/02/22 05:16:04 1.36 @@ -1,5 +1,5 @@ package Palm::Keyring; -# $RedRiver: Keyring.pm,v 1.32 2007/02/19 03:33:56 andrew Exp $ +# $RedRiver: Keyring.pm,v 1.35 2007/02/22 04:11:35 andrew Exp $ ######################################################################## # Keyring.pm *** Perl class for Keyring for Palm OS databases. # @@ -16,6 +16,7 @@ use warnings; use Carp; +$Carp::Verbose = 1; use base qw/ Palm::StdAppInfo /; @@ -28,26 +29,30 @@ my $NULL = chr 0; my @CRYPTS = ( - { # None + { + alias => 'None', name => 'None', keylen => 8, blocksize => 1, default_iter => 500, }, - { # DES-EDE3 + { + alias => 'DES-EDE3', name => 'DES_EDE3', keylen => 24, blocksize => 8, DES_odd_parity => 1, default_iter => 1000, }, - { # AES128 + { + alias => 'AES128', name => 'Rijndael', keylen => 16, blocksize => 16, default_iter => 100, }, - { # AES256 + { + alias => 'AES256', name => 'Rijndael', keylen => 32, blocksize => 16, @@ -123,6 +128,24 @@ return 1; } +# Accessors + +sub crypts +{ + my $crypt = shift; + if ($crypt =~ /\D/) { + foreach my $c (@CRYPTS) { + if ($c->{alias} eq $crypt) { + return $c; + } + } + # didn't find it. + return; + } else { + return $CRYPTS[$crypt]; + } +} + # ParseRecord sub ParseRecord @@ -152,6 +175,7 @@ $rec->{name} = $field->{data}; $rec->{ivec} = $ivec; $rec->{encrypted} = $encrypted; + delete $rec->{data}; } else { die 'Unsupported Version'; @@ -239,7 +263,7 @@ my $unpackstr = ("C1" x 8) # 8 uint8s in an array for the salt - . ("S1" x 2) # the iter (uint16) and the cipher (uint16) + . ("n1" x 2) # the iter (uint16) and the cipher (uint16) . ("C1" x 8); # and finally 8 more uint8s for the hash my (@salt, $iter, $cipher, @hash); @@ -280,7 +304,7 @@ my $packstr = ("C1" x 8) # 8 uint8s in an array for the salt - . ("S1" x 2) # the iter (uint16) and the cipher (uint16) + . ("n1" x 2) # the iter (uint16) and the cipher (uint16) . ("C1" x 8); # and finally 8 more uint8s for the hash my @salt = map { hex $_ } $appinfo->{salt} =~ /../gxm; @@ -306,6 +330,7 @@ my $rec = shift; my $data = shift; my $pass = shift || $self->{password}; + my $ivec = shift; if ( ! $pass && ! $self->{appinfo}->{key}) { croak("password not set!\n"); @@ -335,31 +360,30 @@ $rec->{name} ||= $data->{name}; } elsif ($self->{version} == 5) { - my @recs = ($data, $acct); - my $name; + my @accts = ($data, $acct); if ($self->{options}->{v4compatible}) { $rec->{name} ||= $data->{name}; - foreach my $rec (@recs) { + foreach my $a (@accts) { my @fields; - foreach my $k (sort keys %{ $rec }) { + foreach my $k (sort keys %{ $a }) { my $field = { label => $k, font => 0, - data => $rec->{$k}, + data => $a->{$k}, }; push @fields, $field; } - $rec = \@fields; + $a = \@fields; } } - my $ivec; ($encrypted, $ivec) = _encrypt_v5( - @recs, + @accts, $self->{appinfo}->{key}, $self->{appinfo}->{cipher}, + $ivec, ); - if ($ivec) { + if (defined $ivec) { $rec->{ivec} = $ivec; } @@ -384,8 +408,6 @@ sub _encrypt_v4 { - require Crypt::CBC; - my $new = shift; my $old = shift; my $digest = shift; @@ -459,12 +481,15 @@ my $old = shift; my $key = shift; my $cipher = shift; - my $length = $CRYPTS[ $cipher ]{blocksize}; - my $ivec = shift || pack("C*",map {rand(256)} 1..$length); - + my $ivec = shift; + my $blocksize = $CRYPTS[ $cipher ]{blocksize}; my $keylen = $CRYPTS[ $cipher ]{keylen}; my $cipher_name = $CRYPTS[ $cipher ]{name}; + if (! defined $ivec) { + $ivec = pack("C*",map {rand(256)} 1..$blocksize); + } + my $changed = 0; my $need_newdate = 1; my $date_index; @@ -527,19 +552,20 @@ foreach my $field (@{ $new }) { $decrypted .= _pack_field($field); } - my $encrypted; if ($cipher_name eq 'None') { # do nothing $encrypted = $decrypted; } elsif ($cipher_name eq 'DES_EDE3' or $cipher_name eq 'Rijndael') { + require Crypt::CBC; my $c = Crypt::CBC->new( - -literal_key => 1, -key => $key, + -literal_key => 1, -iv => $ivec, -cipher => $cipher_name, -keysize => $keylen, + -blocksize => $blocksize, -header => 'none', -padding => 'oneandzeroes', ); @@ -633,7 +659,7 @@ sub _decrypt_v5 { - require Crypt::CBC; + my $encrypted = shift; my $key = shift; my $cipher = shift; @@ -641,6 +667,7 @@ my $keylen = $CRYPTS[ $cipher ]{keylen}; my $cipher_name = $CRYPTS[ $cipher ]{name}; + my $blocksize = $CRYPTS[ $cipher ]{blocksize}; my $decrypted; @@ -649,12 +676,14 @@ $decrypted = $encrypted; } elsif ($cipher_name eq 'DES_EDE3' or $cipher_name eq 'Rijndael') { + require Crypt::CBC; my $c = Crypt::CBC->new( - -literal_key => 1, -key => $key, + -literal_key => 1, -iv => $ivec, -cipher => $cipher_name, -keysize => $keylen, + -blocksize => $blocksize, -header => 'none', -padding => 'oneandzeroes', ); @@ -662,7 +691,8 @@ if (! $c) { croak("Unable to set up encryption!"); } - $encrypted .= $NULL x $keylen; # pad out a keylen + my $len = $blocksize - length($encrypted) % $blocksize; + $encrypted .= $NULL x $len; $decrypted = $c->decrypt($encrypted); } else { @@ -761,7 +791,7 @@ } } } elsif ($self->{version} == 5) { - return _password_verify_v5($pass, $self->{appinfo}); + return _password_verify_v5($self->{appinfo}, $pass); } else { # XXX unsupported version } @@ -800,8 +830,8 @@ sub _password_verify_v5 { - my $pass = shift; my $appinfo = shift; + my $pass = shift; my $salt = pack("H*", $appinfo->{salt}); @@ -811,7 +841,9 @@ $CRYPTS[ $appinfo->{cipher} ]{DES_odd_parity}, ); + #print "Iter: '" . $appinfo->{iter} . "'\n"; #print "Key: '". unpack("H*", $key) . "'\n"; + #print "Salt: '". unpack("H*", $salt) . "'\n"; #print "Hash: '". $hash . "'\n"; #print "Hash: '". $appinfo->{masterhash} . "'\n"; @@ -925,6 +957,7 @@ return $key; } +# Helpers sub _calc_keys { @@ -1029,19 +1062,20 @@ $labels[3] = 'lastchange'; $labels[255] = 'notes'; - my ($len) = unpack "S1", $field; + my ($len) = unpack "n1", $field; if ($len + 4 > length $field) { return undef, $field; } - my $unpackstr = "S1 C1 C1 A$len"; - if ($len % 2 && $len + 4 < length $field) { + my $unpackstr = "x2 C1 C1 A$len"; + my $offset = 2 +1 +1 +$len; + if ($len % 2) { # && $len + 4 < length $field) { # trim the 0/1 byte padding for next even address. + $offset++; $unpackstr .= ' x' } - $unpackstr .= ' A*'; - my (undef, $label, $font, $data, $leftover) - = unpack $unpackstr, $field; + my ($label, $font, $data) = unpack $unpackstr, $field; + my $leftover = substr $field, $offset; if ($label == 3) { $data = _parse_keyring_date($data); @@ -1075,7 +1109,7 @@ $data = _pack_keyring_date($data); } my $len = length $data; - my $packstr = "S1 C1 C1 A*"; + my $packstr = "n1 C1 C1 A*"; my $packed = pack $packstr, ($len, $label, $font, $data); @@ -1310,13 +1344,43 @@ =back +For v5 databases there are some additional appinfo fields set. + + $pdb->{appinfo} = { + # normal appinfo stuff described in L + cipher => The index number of the cipher being used + iter => Number of iterations for the cipher + }; + +=head2 crypt + +Pass in the alias of the crypt to use, or the index. + +This is a function, not a method. + + my $c = Palm::Keyring::crypt($cipher); + +$c is now: + + $c = { + alias => (None|DES_EDE3|AES128|AES256), + name => (None|DES_EDE3|Rijndael), + keylen => , + blocksize => , + default_iter => , + }; + =head2 Encrypt - $pdb->Encrypt($rec, $acct[, $password]); + $pdb->Encrypt($rec, $acct[, $password[, $ivec]]); Encrypts an account into a record, either with the password previously used, or with a password that is passed. +$ivec is the initialization vector to use to encrypt the record. This is +not used by v4 databases. Normally this is not passed and is generated +randomly. + $rec is a record from $pdb->{records} or a new_Record(). The v4 $acct is a hashref in the format below. @@ -1400,6 +1464,28 @@ the password. If nothing is passed, it forgets the password that it was remembering. + +After a successful password verification the following fields are set + +For v4 + + $pdb->{digest} = the calculated digest used from the key; + $pdb->{password} = the password that was passed in; + +For v5 + + $pdb->{appinfo} = { + # As described under new() with these additional fields + cipher => The index number of the cipher being used + iter => Number of iterations for the cipher + key => The key that is calculated from the password + and salt and is used to decrypt the records. + masterhash => the hash of the key that is stored in the + database. Either set when Loading the database + or when setting a new password. + salt => the salt that is either read out of the database + or calculated when setting a new password. + }; =head1 DEPENDENCIES