Annotation of palm/Palm-Keyring/lib/Palm/Keyring.pm, Revision 1.49
1.14 andrew 1: package Palm::Keyring;
1.49 ! andrew 2: # $RedRiver: Keyring.pm,v 1.48 2007/09/12 02:44:36 andrew Exp $
1.27 andrew 3: ########################################################################
4: # Keyring.pm *** Perl class for Keyring for Palm OS databases.
5: #
6: # This started as Memo.pm, I just made it work for Keyring.
1.1 andrew 7: #
1.27 andrew 8: # 2006.01.26 #*#*# andrew fresh <andrew@cpan.org>
9: ########################################################################
10: # Copyright (C) 2006, 2007 by Andrew Fresh
1.1 andrew 11: #
1.27 andrew 12: # This program is free software; you can redistribute it and/or modify
13: # it under the same terms as Perl itself.
14: ########################################################################
1.1 andrew 15: use strict;
1.14 andrew 16: use warnings;
1.27 andrew 17:
1.14 andrew 18: use Carp;
19:
20: use base qw/ Palm::StdAppInfo /;
1.1 andrew 21:
1.24 andrew 22: my $ENCRYPT = 1;
23: my $DECRYPT = 0;
24: my $MD5_CBLOCK = 64;
25: my $kSalt_Size = 4;
26: my $EMPTY = q{};
27: my $SPACE = q{ };
28: my $NULL = chr 0;
1.14 andrew 29:
1.28 andrew 30: my @CRYPTS = (
1.34 andrew 31: {
32: alias => 'None',
1.28 andrew 33: name => 'None',
34: keylen => 8,
35: blocksize => 1,
1.29 andrew 36: default_iter => 500,
1.28 andrew 37: },
1.34 andrew 38: {
39: alias => 'DES-EDE3',
1.28 andrew 40: name => 'DES_EDE3',
41: keylen => 24,
42: blocksize => 8,
43: DES_odd_parity => 1,
1.29 andrew 44: default_iter => 1000,
1.28 andrew 45: },
1.34 andrew 46: {
47: alias => 'AES128',
1.28 andrew 48: name => 'Rijndael',
49: keylen => 16,
50: blocksize => 16,
1.29 andrew 51: default_iter => 100,
1.28 andrew 52: },
1.34 andrew 53: {
54: alias => 'AES256',
1.28 andrew 55: name => 'Rijndael',
56: keylen => 32,
57: blocksize => 16,
1.29 andrew 58: default_iter => 250,
1.28 andrew 59: },
60: );
61:
1.46 andrew 62: my %LABELS = (
63: 0 => {
64: id => 0,
65: name => 'name',
66: },
67: 1 => {
68: id => 1,
69: name => 'account',
70: },
71: 2 => {
72: id => 2,
73: name => 'password',
74: },
75: 3 => {
76: id => 3,
77: name => 'lastchange',
78: },
79: 255 => {
80: id => 255,
81: name => 'notes',
82: },
83: );
84:
1.1 andrew 85:
1.47 andrew 86: our $VERSION = '0.96_01';
1.28 andrew 87:
88: sub new
89: {
1.14 andrew 90: my $classname = shift;
1.28 andrew 91: my $options = {};
92:
1.46 andrew 93: if (@_) {
94: # hashref arguments
95: if (ref $_[0] eq 'HASH') {
96: $options = shift;
97: }
98:
99: # CGI style arguments
100: elsif ($_[0] =~ /^-[a-zA-Z0-9_]{1,20}$/) {
101: my %tmp = @_;
102: while ( my($key,$value) = each %tmp) {
103: $key =~ s/^-//;
104: $options->{lc $key} = $value;
105: }
106: }
107:
108: else {
109: $options->{password} = shift;
110: $options->{version} = shift;
111: }
1.28 andrew 112: }
1.1 andrew 113:
1.14 andrew 114: # Create a generic PDB. No need to rebless it, though.
1.28 andrew 115: my $self = $classname->SUPER::new();
1.1 andrew 116:
1.28 andrew 117: $self->{name} = 'Keys-Gtkr'; # Default
118: $self->{creator} = 'Gtkr';
119: $self->{type} = 'Gkyr';
1.14 andrew 120:
121: # The PDB is not a resource database by
122: # default, but it's worth emphasizing,
123: # since MemoDB is explicitly not a PRC.
1.28 andrew 124: $self->{attributes}{resource} = 0;
1.1 andrew 125:
1.28 andrew 126: # Set the version
127: $self->{version} = $options->{version} || 4;
1.1 andrew 128:
1.28 andrew 129: # Set options
130: $self->{options} = $options;
1.1 andrew 131:
1.29 andrew 132: # Set defaults
133: if ($self->{version} == 5) {
134: $self->{options}->{cipher} ||= 0; # 'None'
1.39 andrew 135: my $c = crypts($self->{options}->{cipher})
136: or croak('Unknown cipher ' . $self->{options}->{cipher});
137: $self->{options}->{iterations} ||= $c->{default_iter};
138: $self->{appinfo}->{cipher} ||= $self->{options}->{cipher};
139: $self->{appinfo}->{iter} ||= $self->{options}->{iterations};
1.29 andrew 140: };
141:
1.28 andrew 142: if ( defined $options->{password} ) {
143: $self->Password($options->{password});
1.14 andrew 144: }
1.1 andrew 145:
1.14 andrew 146: return $self;
147: }
1.1 andrew 148:
1.28 andrew 149: sub import
150: {
1.14 andrew 151: Palm::PDB::RegisterPDBHandlers( __PACKAGE__, [ 'Gtkr', 'Gkyr' ], );
152: return 1;
153: }
1.1 andrew 154:
1.34 andrew 155: # Accessors
156:
157: sub crypts
158: {
159: my $crypt = shift;
1.46 andrew 160: if ((! defined $crypt) || (! length $crypt)) {
1.39 andrew 161: return;
162: } elsif ($crypt =~ /\D/) {
1.34 andrew 163: foreach my $c (@CRYPTS) {
164: if ($c->{alias} eq $crypt) {
165: return $c;
166: }
167: }
168: # didn't find it.
169: return;
170: } else {
171: return $CRYPTS[$crypt];
172: }
173: }
174:
1.46 andrew 175: sub labels
176: {
177: my $label = shift;
178:
179: if ((! defined $label) || (! length $label)) {
180: return;
181: } elsif (exists $LABELS{$label}) {
182: return $LABELS{$label};
183: } else {
184: foreach my $l (keys %LABELS) {
185: if ($LABELS{$l}{name} eq $label) {
186: return $LABELS{$l};
187: }
188: }
189:
190: # didn't find it, make one.
191: if ($label =~ /^\d+$/) {
192: return {
193: id => $label,
194: name => undef,
195: };
196: } else {
197: return;
198: }
199: }
200: }
201:
202: # Write
203:
204: sub Write
205: {
206: my $self = shift;
207:
208: if ($self->{version} == 4) {
209: # Give the PDB the first record that will hold the encrypted password
210: my $rec = $self->new_Record;
211: $rec->{data} = $self->{encpassword};
212:
213: if (ref $self->{records} eq 'ARRAY') {
214: unshift @{ $self->{records} }, $rec;
215: } else {
216: $self->{records} = [ $rec ];
217: }
218: }
219:
220: my $rc = $self->SUPER::Write(@_);
221:
222: if ($self->{version} == 4) {
223: shift @{ $self->{records} };
224: }
225:
226: return $rc;
227: }
228:
1.29 andrew 229: # ParseRecord
1.28 andrew 230:
231: sub ParseRecord
232: {
1.14 andrew 233: my $self = shift;
234:
1.16 andrew 235: my $rec = $self->SUPER::ParseRecord(@_);
1.28 andrew 236: return $rec if ! exists $rec->{data};
237:
238: if ($self->{version} == 4) {
239: # skip the first record because it contains the password.
1.46 andrew 240: if (! exists $self->{records}) {
241: $self->{encpassword} = $rec->{data};
242: return '__DELETE_ME__';
243: }
244:
245: if ($self->{records}->[0] eq '__DELETE_ME__') {
246: shift @{ $self->{records} };
247: }
1.28 andrew 248:
249: my ( $name, $encrypted ) = split /$NULL/xm, $rec->{data}, 2;
250:
251: return $rec if ! $encrypted;
1.48 andrew 252: $rec->{plaintext}->{0} = {
1.46 andrew 253: label => 'name',
254: label_id => 0,
255: data => $name,
256: font => 0,
257: };
1.28 andrew 258: $rec->{encrypted} = $encrypted;
259: delete $rec->{data};
260:
261: } elsif ($self->{version} == 5) {
1.39 andrew 262: my $c = crypts( $self->{appinfo}->{cipher} )
263: or croak('Unknown cipher ' . $self->{appinfo}->{cipher});
264: my $blocksize = $c->{blocksize};
1.28 andrew 265: my ($field, $extra) = _parse_field($rec->{data});
1.37 andrew 266: delete $rec->{data};
1.16 andrew 267:
1.48 andrew 268: $rec->{plaintext}->{0} = $field;
1.37 andrew 269: $rec->{ivec} = substr $extra, 0, $blocksize;
270: $rec->{encrypted} = substr $extra, $blocksize;
1.28 andrew 271:
272: } else {
1.46 andrew 273: croak "Unsupported Version $self->{version}";
1.28 andrew 274: return;
275: }
1.12 andrew 276:
1.16 andrew 277: return $rec;
1.14 andrew 278: }
1.11 andrew 279:
1.28 andrew 280: # PackRecord
281:
282: sub PackRecord
283: {
1.16 andrew 284: my $self = shift;
285: my $rec = shift;
286:
1.28 andrew 287: if ($self->{version} == 4) {
288: if ($rec->{encrypted}) {
1.48 andrew 289: my $name = $rec->{plaintext}->{0}->{data} || $EMPTY;
1.46 andrew 290: $rec->{data} = join $NULL, $name, $rec->{encrypted};
1.48 andrew 291: delete $rec->{plaintext};
1.28 andrew 292: delete $rec->{encrypted};
293: }
1.29 andrew 294:
1.28 andrew 295: } elsif ($self->{version} == 5) {
1.37 andrew 296: my $field;
1.48 andrew 297: if ($rec->{plaintext}->{0}) {
298: $field = $rec->{plaintext}->{0};
1.37 andrew 299: } else {
300: $field = {
1.46 andrew 301: 'label' => 'name',
302: 'label_id' => 0,
1.37 andrew 303: 'data' => $EMPTY,
304: 'font' => 0,
305: };
306: }
307: my $packed = _pack_field($field);
1.29 andrew 308:
1.46 andrew 309: $rec->{data} = join $EMPTY, $packed, $rec->{ivec}, $rec->{encrypted};
1.29 andrew 310:
1.28 andrew 311: } else {
1.46 andrew 312: croak "Unsupported Version $self->{version}";
1.16 andrew 313: }
1.1 andrew 314:
1.16 andrew 315: return $self->SUPER::PackRecord($rec, @_);
1.14 andrew 316: }
1.1 andrew 317:
1.28 andrew 318: # ParseAppInfoBlock
319:
320: sub ParseAppInfoBlock
321: {
322: my $self = shift;
323: my $data = shift;
324: my $appinfo = {};
325:
326: &Palm::StdAppInfo::parse_StdAppInfo($appinfo, $data);
327:
328: # int8/uint8
329: # - Signed or Unsigned Byte (8 bits). C types: char, unsigned char
330: # int16/uint16
331: # - Signed or Unsigned Word (16 bits). C types: short, unsigned short
332: # int32/uint32
333: # - Signed or Unsigned Doubleword (32 bits). C types: int, unsigned int
334: # sz
335: # - Zero-terminated C-style string
336:
337: if ($self->{version} == 4) {
338: # Nothing extra for version 4
339:
340: } elsif ($self->{version} == 5) {
341: _parse_appinfo_v5($appinfo) || return;
342:
343: } else {
1.46 andrew 344: croak "Unsupported Version $self->{version}";
1.28 andrew 345: }
346:
347: return $appinfo;
348: }
349:
350: sub _parse_appinfo_v5
351: {
352: my $appinfo = shift;
353:
354: if (! exists $appinfo->{other}) {
355: # XXX Corrupt appinfo?
356: return;
357: }
358:
359: my $unpackstr
360: = ("C1" x 8) # 8 uint8s in an array for the salt
1.35 andrew 361: . ("n1" x 2) # the iter (uint16) and the cipher (uint16)
1.28 andrew 362: . ("C1" x 8); # and finally 8 more uint8s for the hash
363:
364: my (@salt, $iter, $cipher, @hash);
365: (@salt[0..7], $iter, $cipher, @hash[0..7])
366: = unpack $unpackstr, $appinfo->{other};
367:
368: $appinfo->{salt} = sprintf "%02x" x 8, @salt;
369: $appinfo->{iter} = $iter;
370: $appinfo->{cipher} = $cipher;
371: $appinfo->{masterhash} = sprintf "%02x" x 8, @hash;
372: delete $appinfo->{other};
373:
374: return $appinfo
375: }
376:
377: # PackAppInfoBlock
378:
379: sub PackAppInfoBlock
380: {
381: my $self = shift;
382: my $retval;
383:
384: if ($self->{version} == 4) {
385: # Nothing to do for v4
386:
387: } elsif ($self->{version} == 5) {
1.29 andrew 388: _pack_appinfo_v5($self->{appinfo});
1.28 andrew 389: } else {
1.46 andrew 390: croak "Unsupported Version $self->{version}";
1.28 andrew 391: }
392: return &Palm::StdAppInfo::pack_StdAppInfo($self->{appinfo});
393: }
394:
1.29 andrew 395: sub _pack_appinfo_v5
396: {
397: my $appinfo = shift;
398:
399: my $packstr
400: = ("C1" x 8) # 8 uint8s in an array for the salt
1.35 andrew 401: . ("n1" x 2) # the iter (uint16) and the cipher (uint16)
1.29 andrew 402: . ("C1" x 8); # and finally 8 more uint8s for the hash
403:
404: my @salt = map { hex $_ } $appinfo->{salt} =~ /../gxm;
405: my @hash = map { hex $_ } $appinfo->{masterhash} =~ /../gxm;
406:
407: my $packed = pack($packstr,
408: @salt,
409: $appinfo->{iter},
410: $appinfo->{cipher},
411: @hash
412: );
413:
414: $appinfo->{other} = $packed;
415:
416: return $appinfo
417: }
418:
1.28 andrew 419: # Encrypt
420:
421: sub Encrypt
422: {
1.14 andrew 423: my $self = shift;
1.16 andrew 424: my $rec = shift;
1.28 andrew 425: my $pass = shift || $self->{password};
1.48 andrew 426: my $data = shift || $rec->{plaintext};
1.34 andrew 427: my $ivec = shift;
1.16 andrew 428:
1.29 andrew 429: if ( ! $pass && ! $self->{appinfo}->{key}) {
1.28 andrew 430: croak("password not set!\n");
1.16 andrew 431: }
432:
433: if ( ! $rec) {
434: croak("Needed parameter 'record' not passed!\n");
435: }
1.14 andrew 436:
1.16 andrew 437: if ( ! $data) {
1.48 andrew 438: croak("Needed 'plaintext' not passed!\n");
1.14 andrew 439: }
440:
1.29 andrew 441: if ( $pass && ! $self->Password($pass)) {
1.16 andrew 442: croak("Incorrect Password!\n");
443: }
1.14 andrew 444:
1.29 andrew 445: my $acct;
446: if ($rec->{encrypted}) {
447: $acct = $self->Decrypt($rec, $pass);
448: }
449:
450: my $encrypted;
1.28 andrew 451: if ($self->{version} == 4) {
452: $self->{digest} ||= _calc_keys( $pass );
1.46 andrew 453: my $datav4 = {
454: name => $data->{0}->{data},
455: account => $data->{1}->{data},
456: password => $data->{2}->{data},
457: lastchange => $data->{3}->{data},
458: notes => $data->{255}->{data},
459: };
460: my $acctv4 = {
461: name => $acct->{0}->{data},
462: account => $acct->{1}->{data},
463: password => $acct->{2}->{data},
464: lastchange => $acct->{3}->{data},
465: notes => $acct->{255}->{data},
466: };
467: $encrypted = _encrypt_v4($datav4, $acctv4, $self->{digest});
1.29 andrew 468:
469: } elsif ($self->{version} == 5) {
470: ($encrypted, $ivec) = _encrypt_v5(
1.46 andrew 471: $data, $acct,
1.29 andrew 472: $self->{appinfo}->{key},
473: $self->{appinfo}->{cipher},
1.34 andrew 474: $ivec,
1.29 andrew 475: );
1.34 andrew 476: if (defined $ivec) {
1.29 andrew 477: $rec->{ivec} = $ivec;
1.28 andrew 478: }
1.29 andrew 479:
480: } else {
1.46 andrew 481: croak "Unsupported Version $self->{version}";
1.29 andrew 482: }
483:
1.48 andrew 484: $rec->{plaintext}->{0} = $data->{0};
1.46 andrew 485:
1.29 andrew 486: if ($encrypted) {
487: if ($encrypted eq '1') {
1.28 andrew 488: return 1;
489: }
1.29 andrew 490:
491: $rec->{attributes}{Dirty} = 1;
492: $rec->{attributes}{dirty} = 1;
493: $rec->{encrypted} = $encrypted;
494:
495: return 1;
1.28 andrew 496: } else {
1.29 andrew 497: return;
1.28 andrew 498: }
499: }
1.14 andrew 500:
1.28 andrew 501: sub _encrypt_v4
502: {
1.29 andrew 503: my $new = shift;
504: my $old = shift;
1.28 andrew 505: my $digest = shift;
506:
1.29 andrew 507: $new->{account} ||= $EMPTY;
508: $new->{password} ||= $EMPTY;
509: $new->{notes} ||= $EMPTY;
1.1 andrew 510:
1.22 andrew 511: my $changed = 0;
512: my $need_newdate = 0;
1.29 andrew 513: if ($old && %{ $old }) {
1.46 andrew 514: no warnings 'uninitialized';
1.29 andrew 515: foreach my $key (keys %{ $new }) {
1.22 andrew 516: next if $key eq 'lastchange';
1.29 andrew 517: if ($new->{$key} ne $old->{$key}) {
1.22 andrew 518: $changed = 1;
519: last;
520: }
521: }
1.29 andrew 522: if ( exists $new->{lastchange} && exists $old->{lastchange} && (
523: $new->{lastchange}->{day} != $old->{lastchange}->{day} ||
524: $new->{lastchange}->{month} != $old->{lastchange}->{month} ||
525: $new->{lastchange}->{year} != $old->{lastchange}->{year}
1.22 andrew 526: )) {
527: $changed = 1;
528: $need_newdate = 0;
529: } else {
530: $need_newdate = 1;
531: }
532:
533: } else {
534: $changed = 1;
535: }
536:
537: # no need to re-encrypt if it has not changed.
538: return 1 if ! $changed;
539:
1.21 andrew 540: my ($day, $month, $year);
541:
1.29 andrew 542: if ($new->{lastchange} && ! $need_newdate ) {
543: $day = $new->{lastchange}->{day} || 1;
544: $month = $new->{lastchange}->{month} || 0;
545: $year = $new->{lastchange}->{year} || 0;
1.22 andrew 546:
547: # XXX Need to actually validate the above information somehow
548: if ($year >= 1900) {
549: $year -= 1900;
550: }
551: } else {
552: $need_newdate = 1;
553: }
554:
555: if ($need_newdate) {
1.21 andrew 556: ($day, $month, $year) = (localtime)[3,4,5];
557: }
1.22 andrew 558:
1.29 andrew 559: my $packed_date = _pack_keyring_date( {
1.28 andrew 560: year => $year,
561: month => $month,
562: day => $day,
563: });
1.19 andrew 564:
1.16 andrew 565: my $plaintext = join $NULL,
1.29 andrew 566: $new->{account}, $new->{password}, $new->{notes}, $packed_date;
1.1 andrew 567:
1.28 andrew 568: return _crypt3des( $plaintext, $digest, $ENCRYPT );
569: }
1.11 andrew 570:
1.29 andrew 571: sub _encrypt_v5
572: {
573: my $new = shift;
574: my $old = shift;
575: my $key = shift;
576: my $cipher = shift;
1.34 andrew 577: my $ivec = shift;
1.39 andrew 578: my $c = crypts($cipher) or croak('Unknown cipher ' . $cipher);
1.29 andrew 579:
1.34 andrew 580: if (! defined $ivec) {
1.39 andrew 581: $ivec = pack("C*",map {rand(256)} 1..$c->{blocksize});
1.34 andrew 582: }
583:
1.29 andrew 584: my $changed = 0;
585: my $need_newdate = 1;
1.46 andrew 586: if ($new->{3}->{data}) {
587: $need_newdate = 0;
588: }
589: foreach my $k (keys %{ $new }) {
590: if (! $old) {
591: $changed = 1;
592: } elsif ($k == 3) {
593: if ($old && (
594: $new->{$k}{data}{day} == $old->{$k}{data}{day} &&
595: $new->{$k}{data}{month} == $old->{$k}{data}{month} &&
596: $new->{$k}{data}{year} == $old->{$k}{data}{year}
1.29 andrew 597: )) {
598: $changed = 1;
1.46 andrew 599: $need_newdate = 1;
1.29 andrew 600: }
601:
1.46 andrew 602: } else {
603: my $n = join ':', sort %{ $new->{$k} };
604: my $o = join ':', sort %{ $old->{$k} };
1.29 andrew 605: if ($n ne $o) {
606: $changed = 1;
607: }
608: }
609: }
610:
611: return 1, 0 if $changed == 0;
612:
1.46 andrew 613: if ($need_newdate) {
1.29 andrew 614: my ($day, $month, $year) = (localtime)[3,4,5];
1.46 andrew 615: $new->{3} = {
616: label => 'lastchange',
617: label_id => 3,
618: font => 0,
619: data => {
620: year => $year,
621: month => $month,
622: day => $day,
1.47 andrew 623: },
1.29 andrew 624: };
625: } else {
626: # XXX Need to actually validate the above information somehow
1.46 andrew 627: if ($new->{3}->{data}->{year} >= 1900) {
628: $new->{3}->{data}->{year} -= 1900;
1.29 andrew 629: }
630: }
631:
1.48 andrew 632: my $plaintext;
1.46 andrew 633: foreach my $k (keys %{ $new }) {
1.48 andrew 634: $plaintext .= _pack_field($new->{$k});
1.29 andrew 635: }
1.46 andrew 636:
1.29 andrew 637: my $encrypted;
1.39 andrew 638: if ($c->{name} eq 'None') {
1.29 andrew 639: # do nothing
1.48 andrew 640: $encrypted = $plaintext;
1.29 andrew 641:
1.39 andrew 642: } elsif ($c->{name} eq 'DES_EDE3' or $c->{name} eq 'Rijndael') {
1.35 andrew 643: require Crypt::CBC;
1.39 andrew 644: my $cbc = Crypt::CBC->new(
1.35 andrew 645: -key => $key,
1.29 andrew 646: -literal_key => 1,
647: -iv => $ivec,
1.39 andrew 648: -cipher => $c->{name},
649: -keysize => $c->{keylen},
650: -blocksize => $c->{blocksize},
1.29 andrew 651: -header => 'none',
652: -padding => 'oneandzeroes',
653: );
654:
655: if (! $c) {
656: croak("Unable to set up encryption!");
657: }
658:
1.48 andrew 659: $encrypted = $cbc->encrypt($plaintext);
1.29 andrew 660:
661: } else {
1.46 andrew 662: croak "Unsupported Crypt $c->{name}";
1.29 andrew 663: }
664:
665: return $encrypted, $ivec;
666: }
667:
1.28 andrew 668: # Decrypt
1.1 andrew 669:
1.31 andrew 670: sub Decrypt
1.28 andrew 671: {
1.14 andrew 672: my $self = shift;
1.16 andrew 673: my $rec = shift;
1.28 andrew 674: my $pass = shift || $self->{password};
1.16 andrew 675:
1.29 andrew 676: if ( ! $pass && ! $self->{appinfo}->{key}) {
1.28 andrew 677: croak("password not set!\n");
1.16 andrew 678: }
679:
680: if ( ! $rec) {
1.19 andrew 681: croak("Needed parameter 'record' not passed!\n");
1.16 andrew 682: }
1.14 andrew 683:
1.30 andrew 684: if ( $pass && ! $self->Password($pass)) {
1.16 andrew 685: croak("Invalid Password!\n");
1.14 andrew 686: }
687:
1.28 andrew 688: if ( ! $rec->{encrypted} ) {
1.16 andrew 689: croak("No encrypted content!");
690: }
1.14 andrew 691:
1.48 andrew 692: my $plaintext;
1.28 andrew 693: if ($self->{version} == 4) {
694: $self->{digest} ||= _calc_keys( $pass );
695: my $acct = _decrypt_v4($rec->{encrypted}, $self->{digest});
1.48 andrew 696: $plaintext = {
697: 0 => $rec->{plaintext}->{0},
1.46 andrew 698: 1 => {
699: label => 'account',
700: label_id => 1,
701: font => 0,
702: data => $acct->{account},
703: },
704: 2 => {
705: label => 'password',
706: label_id => 2,
707: font => 0,
708: data => $acct->{password},
709: },
710: 3 => {
711: label => 'lastchange',
712: label_id => 3,
713: font => 0,
714: data => $acct->{lastchange},
715: },
716: 255 => {
717: label => 'notes',
718: label_id => 255,
719: font => 0,
720: data => $acct->{notes},
721: },
722: };
1.29 andrew 723:
1.28 andrew 724: } elsif ($self->{version} == 5) {
1.48 andrew 725: $plaintext = _decrypt_v5(
1.29 andrew 726: $rec->{encrypted}, $self->{appinfo}->{key},
727: $self->{appinfo}->{cipher}, $rec->{ivec},
1.28 andrew 728: );
1.48 andrew 729: $plaintext->{0} ||= $rec->{plaintext}->{0};
1.29 andrew 730:
1.28 andrew 731: } else {
1.46 andrew 732: croak "Unsupported Version $self->{version}";
1.28 andrew 733: }
1.48 andrew 734:
735: if ($plaintext) {
736: $rec->{plaintext} = $plaintext;
737: return $plaintext;
738: }
1.28 andrew 739: return;
740: }
1.14 andrew 741:
1.28 andrew 742: sub _decrypt_v4
743: {
744: my $encrypted = shift;
745: my $digest = shift;
746:
1.48 andrew 747: my $plaintext = _crypt3des( $encrypted, $digest, $DECRYPT );
1.29 andrew 748: my ( $account, $password, $notes, $packed_date )
1.48 andrew 749: = split /$NULL/xm, $plaintext, 4;
1.14 andrew 750:
1.28 andrew 751: my $modified;
1.29 andrew 752: if ($packed_date) {
753: $modified = _parse_keyring_date($packed_date);
1.19 andrew 754: }
755:
1.16 andrew 756: return {
1.20 andrew 757: account => $account,
758: password => $password,
759: notes => $notes,
1.28 andrew 760: lastchange => $modified,
1.16 andrew 761: };
762: }
1.14 andrew 763:
1.28 andrew 764: sub _decrypt_v5
765: {
1.34 andrew 766:
1.28 andrew 767: my $encrypted = shift;
768: my $key = shift;
769: my $cipher = shift;
1.29 andrew 770: my $ivec = shift;
771:
1.39 andrew 772: my $c = crypts($cipher) or croak('Unknown cipher ' . $cipher);
1.28 andrew 773:
1.48 andrew 774: my $plaintext;
1.28 andrew 775:
1.39 andrew 776: if ($c->{name} eq 'None') {
1.28 andrew 777: # do nothing
1.48 andrew 778: $plaintext = $encrypted;
1.28 andrew 779:
1.39 andrew 780: } elsif ($c->{name} eq 'DES_EDE3' or $c->{name} eq 'Rijndael') {
1.35 andrew 781: require Crypt::CBC;
1.39 andrew 782: my $cbc = Crypt::CBC->new(
1.35 andrew 783: -key => $key,
1.29 andrew 784: -literal_key => 1,
785: -iv => $ivec,
1.39 andrew 786: -cipher => $c->{name},
787: -keysize => $c->{keylen},
788: -blocksize => $c->{blocksize},
1.29 andrew 789: -header => 'none',
790: -padding => 'oneandzeroes',
791: );
792:
1.28 andrew 793: if (! $c) {
794: croak("Unable to set up encryption!");
795: }
1.39 andrew 796: my $len = $c->{blocksize} - length($encrypted) % $c->{blocksize};
1.34 andrew 797: $encrypted .= $NULL x $len;
1.48 andrew 798: $plaintext = $cbc->decrypt($encrypted);
1.28 andrew 799:
800: } else {
1.46 andrew 801: croak "Unsupported Crypt $c->{name}";
1.28 andrew 802: }
803:
1.46 andrew 804: my %fields;
1.48 andrew 805: while ($plaintext) {
1.28 andrew 806: my $field;
1.48 andrew 807: ($field, $plaintext) = _parse_field($plaintext);
1.28 andrew 808: if (! $field) {
809: last;
810: }
1.46 andrew 811: $fields{ $field->{label_id} } = $field;
1.28 andrew 812: }
813:
1.46 andrew 814: return \%fields;
1.28 andrew 815: }
816:
817: # Password
818:
819: sub Password
820: {
1.16 andrew 821: my $self = shift;
1.24 andrew 822: my $pass = shift;
1.16 andrew 823: my $new_pass = shift;
1.14 andrew 824:
1.24 andrew 825: if (! $pass) {
826: delete $self->{password};
1.30 andrew 827: delete $self->{appinfo}->{key};
1.28 andrew 828: return 1;
1.24 andrew 829: }
830:
1.29 andrew 831: if (
1.46 andrew 832: ($self->{version} == 4 && ! exists $self->{encpassword}) ||
1.29 andrew 833: ($self->{version} == 5 && ! exists $self->{appinfo}->{masterhash})
834: ) {
1.16 andrew 835: return $self->_password_update($pass);
836: }
837:
838: if ($new_pass) {
839: my @accts = ();
1.46 andrew 840: foreach my $rec (@{ $self->{records} }) {
841: my $acct = $self->Decrypt($rec, $pass);
1.16 andrew 842: if ( ! $acct ) {
1.48 andrew 843: croak("Couldn't decrypt $rec->{plaintext}->{0}->{data}");
1.16 andrew 844: }
845: push @accts, $acct;
846: }
1.14 andrew 847:
1.16 andrew 848: if ( ! $self->_password_update($new_pass)) {
849: croak("Couldn't set new password!");
850: }
851: $pass = $new_pass;
1.1 andrew 852:
1.16 andrew 853: foreach my $i (0..$#accts) {
1.28 andrew 854: delete $self->{records}->[$i]->{encrypted};
1.48 andrew 855: $self->{records}->[$i]->{plaintext} = $accts[$i];
856: $self->Encrypt($self->{records}->[$i], $pass);
1.16 andrew 857: }
1.14 andrew 858: }
1.1 andrew 859:
1.28 andrew 860: if (defined $self->{password} && $pass eq $self->{password}) {
861: # already verified this password
862: return 1;
863: }
864:
865: if ($self->{version} == 4) {
1.46 andrew 866: my $valid = _password_verify_v4($pass, $self->{encpassword});
1.28 andrew 867:
1.46 andrew 868: # May as well generate the keys we need now,
869: # since we know the password is right
1.28 andrew 870: if ($valid) {
871: $self->{digest} = _calc_keys($pass);
872: if ($self->{digest} ) {
873: $self->{password} = $pass;
874: return 1;
875: }
876: }
877: } elsif ($self->{version} == 5) {
1.35 andrew 878: return _password_verify_v5($self->{appinfo}, $pass);
1.28 andrew 879: } else {
1.46 andrew 880: croak "Unsupported version $self->{version}";
1.28 andrew 881: }
882:
883: return;
884: }
885:
886: sub _password_verify_v4
887: {
1.32 andrew 888: require Digest::MD5;
889: import Digest::MD5 qw(md5);
890:
1.28 andrew 891: my $pass = shift;
892: my $data = shift;
893:
894: if (! $pass) { croak('No password specified!'); };
895:
896: # XXX die "No encrypted password in file!" unless defined $data;
897: if ( ! defined $data) { return; };
898:
899: $data =~ s/$NULL$//xm;
900:
901: my $salt = substr $data, 0, $kSalt_Size;
902:
903: my $msg = $salt . $pass;
904: $msg .= "\0" x ( $MD5_CBLOCK - length $msg );
905:
906: my $digest = md5($msg);
907:
1.33 andrew 908: if ($data ne $salt . $digest ) {
1.28 andrew 909: return;
910: }
911:
912: return 1;
913: }
914:
915: sub _password_verify_v5
916: {
1.35 andrew 917: my $appinfo = shift;
1.28 andrew 918: my $pass = shift;
919:
920: my $salt = pack("H*", $appinfo->{salt});
921:
1.39 andrew 922: my $c = crypts($appinfo->{cipher})
923: or croak('Unknown cipher ' . $appinfo->{cipher});
1.29 andrew 924: my ($key, $hash) = _calc_key_v5(
925: $pass, $salt, $appinfo->{iter},
1.39 andrew 926: $c->{keylen},
927: $c->{DES_odd_parity},
1.28 andrew 928: );
929:
1.35 andrew 930: #print "Iter: '" . $appinfo->{iter} . "'\n";
1.28 andrew 931: #print "Key: '". unpack("H*", $key) . "'\n";
1.35 andrew 932: #print "Salt: '". unpack("H*", $salt) . "'\n";
1.29 andrew 933: #print "Hash: '". $hash . "'\n";
1.28 andrew 934: #print "Hash: '". $appinfo->{masterhash} . "'\n";
935:
1.29 andrew 936: if ($appinfo->{masterhash} eq $hash) {
1.28 andrew 937: $appinfo->{key} = $key;
938: } else {
939: return;
940: }
1.29 andrew 941:
942: return $key;
943: }
944:
945:
946: sub _password_update
947: {
948: # It is very important to Encrypt after calling this
949: # (Although it is generally only called by Encrypt)
950: # because otherwise the data will be out of sync with the
951: # password, and that would suck!
952: my $self = shift;
953: my $pass = shift;
954:
955: if ($self->{version} == 4) {
956: my $data = _password_update_v4($pass, @_);
957:
958: if (! $data) {
959: carp("Failed to update password!");
960: return;
961: }
962:
963: # AFAIK the thing we use to test the password is
964: # always in the first entry
1.46 andrew 965: $self->{encpassword} = $data;
1.29 andrew 966: $self->{password} = $pass;
967: $self->{digest} = _calc_keys( $self->{password} );
968:
969: return 1;
970:
971: } elsif ($self->{version} == 5) {
972: my $cipher = shift || $self->{appinfo}->{cipher};
973: my $iter = shift || $self->{appinfo}->{iter};
974: my $salt = shift || 0;
975:
976: my $hash = _password_update_v5(
977: $self->{appinfo}, $pass, $cipher, $iter, $salt
978: );
979:
980: if (! $hash) {
981: carp("Failed to update password!");
982: return;
983: }
984:
985: return 1;
986: } else {
987: croak("Unsupported version ($self->{version})");
988: }
989:
990: return;
991: }
992:
993: sub _password_update_v4
994: {
1.32 andrew 995: require Digest::MD5;
996: import Digest::MD5 qw(md5);
997:
1.29 andrew 998: my $pass = shift;
999:
1000: if (! defined $pass) { croak('No password specified!'); };
1001:
1002: my $salt;
1003: for ( 1 .. $kSalt_Size ) {
1004: $salt .= chr int rand 255;
1005: }
1006:
1007: my $msg = $salt . $pass;
1008:
1009: $msg .= "\0" x ( $MD5_CBLOCK - length $msg );
1010:
1011: my $digest = md5($msg);
1012:
1013: my $data = $salt . $digest; # . "\0";
1014:
1015: return $data;
1016: }
1017:
1018: sub _password_update_v5
1019: {
1020: my $appinfo = shift;
1021: my $pass = shift;
1022: my $cipher = shift;
1023: my $iter = shift;
1024:
1025: # I thought this needed to be 'blocksize', but apparently not.
1026: #my $length = $CRYPTS[ $cipher ]{blocksize};
1027: my $length = 8;
1028: my $salt = shift || pack("C*",map {rand(256)} 1..$length);
1029:
1.39 andrew 1030: my $c = crypts($cipher) or croak('Unknown cipher ' . $cipher);
1.29 andrew 1031: my ($key, $hash) = _calc_key_v5(
1032: $pass, $salt, $iter,
1.39 andrew 1033: $c->{keylen},
1034: $c->{DES_odd_parity},
1.29 andrew 1035: );
1036:
1037: $appinfo->{salt} = unpack "H*", $salt;
1038: $appinfo->{iter} = $iter;
1039: $appinfo->{cipher} = $cipher;
1.39 andrew 1040: $appinfo->{masterhash} = $hash;
1.29 andrew 1041: $appinfo->{key} = $key;
1042:
1.28 andrew 1043: return $key;
1.1 andrew 1044: }
1045:
1.48 andrew 1046: sub Unlock
1047: {
1048: my $self = shift;
1049: my ($pass) = @_;
1050: $pass ||= $self->{password};
1051:
1052: if ( $pass && ! $self->Password($pass)) {
1053: croak("Invalid Password!\n");
1054: }
1055:
1056: foreach my $rec (@{ $self->{records} }) {
1057: $self->Decrypt($rec);
1058: }
1059:
1060: return 1;
1061:
1062: }
1063:
1064: sub Lock
1065: {
1066: my $self = shift;
1067:
1068: $self->Password();
1069:
1070: foreach my $rec (@{ $self->{records} }) {
1071: my $name = $rec->{plaintext}->{0};
1072: delete $rec->{plaintext};
1073: $rec->{plaintext}->{0} = $name;
1074: }
1075:
1076: return 1;
1077: }
1078:
1.34 andrew 1079: # Helpers
1.28 andrew 1080:
1081: sub _calc_keys
1082: {
1.14 andrew 1083: my $pass = shift;
1084: if (! defined $pass) { croak('No password defined!'); };
1085:
1086: my $digest = md5($pass);
1087:
1088: my ( $key1, $key2 ) = unpack 'a8a8', $digest;
1089:
1090: #--------------------------------------------------
1091: # print "key1: $key1: ", length $key1, "\n";
1092: # print "key2: $key2: ", length $key2, "\n";
1093: #--------------------------------------------------
1094:
1095: $digest = unpack 'H*', $key1 . $key2 . $key1;
1096:
1097: #--------------------------------------------------
1098: # print "Digest: ", $digest, "\n";
1099: # print length $digest, "\n";
1100: #--------------------------------------------------
1101:
1102: return $digest;
1.3 andrew 1103: }
1104:
1.29 andrew 1105: sub _calc_key_v5
1106: {
1107: my ($pass, $salt, $iter, $keylen, $dop) = @_;
1108:
1.32 andrew 1109: require Digest::HMAC_SHA1;
1110: import Digest::HMAC_SHA1 qw(hmac_sha1);
1111: require Digest::SHA1;
1112: import Digest::SHA1 qw(sha1);
1113:
1.29 andrew 1114: my $key = _pbkdf2( $pass, $salt, $iter, $keylen, \&hmac_sha1 );
1.43 andrew 1115: if ($dop) { $key = _DES_odd_parity($key); }
1.29 andrew 1116:
1117: my $hash = unpack("H*", substr(sha1($key.$salt),0, 8));
1118:
1119: return $key, $hash;
1120: }
1121:
1.28 andrew 1122: sub _crypt3des
1123: {
1.32 andrew 1124: require Crypt::DES;
1125:
1.28 andrew 1126: my ( $plaintext, $passphrase, $flag ) = @_;
1127:
1128: $passphrase .= $SPACE x ( 16 * 3 );
1129: my $cyphertext = $EMPTY;
1130:
1131: my $size = length $plaintext;
1.14 andrew 1132:
1.28 andrew 1133: #print "STRING: '$plaintext' - Length: " . (length $plaintext) . "\n";
1.11 andrew 1134:
1.28 andrew 1135: my @C;
1136: for ( 0 .. 2 ) {
1137: $C[$_] =
1138: new Crypt::DES( pack 'H*', ( substr $passphrase, 16 * $_, 16 ));
1.16 andrew 1139: }
1140:
1.28 andrew 1141: for ( 0 .. ( ($size) / 8 ) ) {
1142: my $pt = substr $plaintext, $_ * 8, 8;
1143:
1144: #print "PT: '$pt' - Length: " . length($pt) . "\n";
1145: if (! length $pt) { next; };
1146: if ( (length $pt) < 8 ) {
1147: if ($flag == $DECRYPT) { croak('record not 8 byte padded'); };
1148: my $len = 8 - (length $pt);
1149: $pt .= ($NULL x $len);
1150: }
1151: if ( $flag == $ENCRYPT ) {
1152: $pt = $C[0]->encrypt($pt);
1153: $pt = $C[1]->decrypt($pt);
1154: $pt = $C[2]->encrypt($pt);
1155: }
1156: else {
1157: $pt = $C[0]->decrypt($pt);
1158: $pt = $C[1]->encrypt($pt);
1159: $pt = $C[2]->decrypt($pt);
1160: }
1161:
1162: #print "PT: '$pt' - Length: " . length($pt) . "\n";
1163: $cyphertext .= $pt;
1164: }
1.11 andrew 1165:
1.28 andrew 1166: $cyphertext =~ s/$NULL+$//xm;
1.11 andrew 1167:
1.28 andrew 1168: #print "CT: '$cyphertext' - Length: " . length($cyphertext) . "\n";
1.11 andrew 1169:
1.28 andrew 1170: return $cyphertext;
1171: }
1.11 andrew 1172:
1.28 andrew 1173: sub _parse_field
1174: {
1175: my $field = shift;
1176:
1.46 andrew 1177: my ($len) = unpack "n", $field;
1.28 andrew 1178: if ($len + 4 > length $field) {
1179: return undef, $field;
1180: }
1.34 andrew 1181: my $unpackstr = "x2 C1 C1 A$len";
1182: my $offset = 2 +1 +1 +$len;
1.46 andrew 1183: if ($len % 2) {
1.28 andrew 1184: # trim the 0/1 byte padding for next even address.
1.34 andrew 1185: $offset++;
1.28 andrew 1186: $unpackstr .= ' x'
1187: }
1.11 andrew 1188:
1.34 andrew 1189: my ($label, $font, $data) = unpack $unpackstr, $field;
1190: my $leftover = substr $field, $offset;
1.11 andrew 1191:
1.46 andrew 1192: my $label_id = $label;
1193: my $l = labels($label);
1194: if ($l) {
1195: $label = $l->{name} || $l->{id};
1196: $label_id = $l->{id};
1197: }
1198:
1199: if ($label_id && $label_id == 3) {
1200: ($data) = substr $field, 4, $len;
1.28 andrew 1201: $data = _parse_keyring_date($data);
1.14 andrew 1202: }
1.28 andrew 1203: return {
1204: #len => $len,
1.46 andrew 1205: label => $label,
1206: label_id => $label_id,
1.28 andrew 1207: font => $font,
1208: data => $data,
1209: }, $leftover;
1.6 andrew 1210: }
1211:
1.29 andrew 1212: sub _pack_field
1213: {
1214: my $field = shift;
1.28 andrew 1215:
1.37 andrew 1216: my $packed;
1217: if (defined $field) {
1218: my $label = $field->{label_id} || 0;
1219: if (defined $field->{label} && ! $label) {
1.46 andrew 1220: $label = $field->{label};
1221: }
1222:
1223: my $l = labels($field->{label});
1224: if ($l) {
1225: $label = $l->{id};
1.37 andrew 1226: }
1.46 andrew 1227:
1.37 andrew 1228: my $font = $field->{font} || 0;
1229: my $data = defined $field->{data} ? $field->{data} : $EMPTY;
1230:
1231: if ($label && $label == 3) {
1232: $data = _pack_keyring_date($data);
1233: }
1234: my $len = length $data;
1235: my $packstr = "n1 C1 C1 A*";
1236:
1237: $packed = pack $packstr, ($len, $label, $font, $data);
1238:
1239: if ($len % 2) {
1240: # add byte padding for next even address.
1241: $packed .= $NULL;
1242: }
1243: } else {
1.38 andrew 1244: my $packstr = "n1 C1 C1 x1";
1.37 andrew 1245: $packed = pack $packstr, 0, 0, 0;
1.14 andrew 1246: }
1247:
1.29 andrew 1248: return $packed;
1249: }
1.11 andrew 1250:
1.29 andrew 1251: sub _parse_keyring_date
1252: {
1253: my $data = shift;
1.11 andrew 1254:
1.29 andrew 1255: my $u = unpack 'n', $data;
1256: my $year = (($u & 0xFE00) >> 9) + 4; # since 1900
1257: my $month = (($u & 0x01E0) >> 5) - 1; # 0-11
1258: my $day = (($u & 0x001F) >> 0); # 1-31
1.11 andrew 1259:
1.29 andrew 1260: return {
1261: year => $year,
1262: month => $month || 0,
1263: day => $day || 1,
1264: };
1265: }
1.11 andrew 1266:
1.29 andrew 1267: sub _pack_keyring_date
1268: {
1269: my $d = shift;
1270: my $year = $d->{year};
1271: my $month = $d->{month};
1272: my $day = $d->{day};
1.11 andrew 1273:
1.29 andrew 1274: $year -= 4;
1275: $month++;
1.11 andrew 1276:
1.46 andrew 1277: return pack 'n*', $day | ($month << 5) | ($year << 9);
1.1 andrew 1278: }
1.29 andrew 1279:
1.1 andrew 1280:
1.28 andrew 1281: sub _hexdump
1282: {
1283: my $prefix = shift; # What to print in front of each line
1284: my $data = shift; # The data to dump
1285: my $maxlines = shift; # Max # of lines to dump
1286: my $offset; # Offset of current chunk
1287:
1288: for ($offset = 0; $offset < length($data); $offset += 16)
1289: {
1290: my $hex; # Hex values of the data
1291: my $ascii; # ASCII values of the data
1292: my $chunk; # Current chunk of data
1293:
1294: last if defined($maxlines) && ($offset >= ($maxlines * 16));
1.14 andrew 1295:
1.28 andrew 1296: $chunk = substr($data, $offset, 16);
1.14 andrew 1297:
1.28 andrew 1298: ($hex = $chunk) =~ s/./sprintf "%02x ", ord($&)/ges;
1.11 andrew 1299:
1.28 andrew 1300: ($ascii = $chunk) =~ y/\040-\176/./c;
1.14 andrew 1301:
1.28 andrew 1302: printf "%s %-48s|%-16s|\n", $prefix, $hex, $ascii;
1.14 andrew 1303: }
1.28 andrew 1304: }
1305:
1306: sub _bindump
1307: {
1308: my $prefix = shift; # What to print in front of each line
1309: my $data = shift; # The data to dump
1310: my $maxlines = shift; # Max # of lines to dump
1311: my $offset; # Offset of current chunk
1312:
1313: for ($offset = 0; $offset < length($data); $offset += 8)
1314: {
1315: my $bin; # binary values of the data
1316: my $ascii; # ASCII values of the data
1317: my $chunk; # Current chunk of data
1.14 andrew 1318:
1.28 andrew 1319: last if defined($maxlines) && ($offset >= ($maxlines * 8));
1.14 andrew 1320:
1.28 andrew 1321: $chunk = substr($data, $offset, 8);
1.14 andrew 1322:
1.28 andrew 1323: ($bin = $chunk) =~ s/./sprintf "%08b ", ord($&)/ges;
1.14 andrew 1324:
1.28 andrew 1325: ($ascii = $chunk) =~ y/\040-\176/./c;
1.14 andrew 1326:
1.28 andrew 1327: printf "%s %-72s|%-8s|\n", $prefix, $bin, $ascii;
1.14 andrew 1328: }
1.28 andrew 1329: }
1.14 andrew 1330:
1.28 andrew 1331: # Thanks to Jochen Hoenicke <hoenicke@gmail.com>
1332: # (one of the authors of Palm Keyring)
1333: # for these next two subs.
1334:
1335: # Usage pbkdf2(password, salt, iter, keylen, prf)
1336: # iter is number of iterations
1337: # keylen is length of generated key in bytes
1338: # prf is the pseudo random function (e.g. hmac_sha1)
1339: # returns the key.
1340: sub _pbkdf2($$$$$)
1341: {
1342: my ($password, $salt, $iter, $keylen, $prf) = @_;
1343: my ($k, $t, $u, $ui, $i);
1344: $t = "";
1345: for ($k = 1; length($t) < $keylen; $k++) {
1346: $u = $ui = &$prf($salt.pack('N', $k), $password);
1347: for ($i = 1; $i < $iter; $i++) {
1348: $ui = &$prf($ui, $password);
1349: $u ^= $ui;
1350: }
1351: $t .= $u;
1352: }
1353: return substr($t, 0, $keylen);
1354: }
1.11 andrew 1355:
1.43 andrew 1356: sub _DES_odd_parity($) {
1.28 andrew 1357: my $key = $_[0];
1358: my ($r, $i);
1359: my @odd_parity = (
1360: 1, 1, 2, 2, 4, 4, 7, 7, 8, 8, 11, 11, 13, 13, 14, 14,
1361: 16, 16, 19, 19, 21, 21, 22, 22, 25, 25, 26, 26, 28, 28, 31, 31,
1362: 32, 32, 35, 35, 37, 37, 38, 38, 41, 41, 42, 42, 44, 44, 47, 47,
1363: 49, 49, 50, 50, 52, 52, 55, 55, 56, 56, 59, 59, 61, 61, 62, 62,
1364: 64, 64, 67, 67, 69, 69, 70, 70, 73, 73, 74, 74, 76, 76, 79, 79,
1365: 81, 81, 82, 82, 84, 84, 87, 87, 88, 88, 91, 91, 93, 93, 94, 94,
1366: 97, 97, 98, 98,100,100,103,103,104,104,107,107,109,109,110,110,
1367: 112,112,115,115,117,117,118,118,121,121,122,122,124,124,127,127,
1368: 128,128,131,131,133,133,134,134,137,137,138,138,140,140,143,143,
1369: 145,145,146,146,148,148,151,151,152,152,155,155,157,157,158,158,
1370: 161,161,162,162,164,164,167,167,168,168,171,171,173,173,174,174,
1371: 176,176,179,179,181,181,182,182,185,185,186,186,188,188,191,191,
1372: 193,193,194,194,196,196,199,199,200,200,203,203,205,205,206,206,
1373: 208,208,211,211,213,213,214,214,217,217,218,218,220,220,223,223,
1374: 224,224,227,227,229,229,230,230,233,233,234,234,236,236,239,239,
1375: 241,241,242,242,244,244,247,247,248,248,251,251,253,253,254,254);
1376: for ($i = 0; $i< length($key); $i++) {
1377: $r .= chr($odd_parity[ord(substr($key, $i, 1))]);
1378: }
1379: return $r;
1.14 andrew 1380: }
1.11 andrew 1381:
1.14 andrew 1382: 1;
1383: __END__
1384: =head1 NAME
1.11 andrew 1385:
1.14 andrew 1386: Palm::Keyring - Handler for Palm Keyring databases.
1.1 andrew 1387:
1.14 andrew 1388: =head1 DESCRIPTION
1.7 andrew 1389:
1.14 andrew 1390: The Keyring PDB handler is a helper class for the Palm::PDB package. It
1391: parses Keyring for Palm OS databases. See
1392: L<http://gnukeyring.sourceforge.net/>.
1.1 andrew 1393:
1.49 ! andrew 1394: It has the standard Palm::PDB methods with 4 additional public methods.
! 1395: Unlock, Lock, Decrypt and Encrypt.
1.1 andrew 1396:
1.37 andrew 1397: It currently supports the v4 Keyring databases as well as
1.49 ! andrew 1398: the pre-release v5 databases.
1.1 andrew 1399:
1.14 andrew 1400: =head1 SYNOPSIS
1.1 andrew 1401:
1.16 andrew 1402: use Palm::PDB;
1403: use Palm::Keyring;
1.17 andrew 1404:
1405: my $pass = 'password';
1.18 andrew 1406: my $file = 'Keys-Gtkr.pdb';
1407: my $pdb = new Palm::PDB;
1.16 andrew 1408: $pdb->Load($file);
1.17 andrew 1409:
1.49 ! andrew 1410: $pdb->Unlock($pass);
1.46 andrew 1411: foreach my $rec (@{ $pdb->{records} }) {
1.49 ! andrew 1412: print $rec->{plaintext}->{0}->{data}, ' - ',
! 1413: $rec->{plaintext}->{1}->{data}, "\n";
1.16 andrew 1414: }
1.49 ! andrew 1415: $pdb->Lock();
1.1 andrew 1416:
1.14 andrew 1417: =head1 SUBROUTINES/METHODS
1.1 andrew 1418:
1.14 andrew 1419: =head2 new
1.11 andrew 1420:
1.31 andrew 1421: $pdb = new Palm::Keyring([$password[, $version]]);
1.11 andrew 1422:
1.14 andrew 1423: Create a new PDB, initialized with the various Palm::Keyring fields
1424: and an empty record list.
1.11 andrew 1425:
1.14 andrew 1426: Use this method if you're creating a Keyring PDB from scratch otherwise you
1.16 andrew 1427: can just use Palm::PDB::new() before calling Load().
1.11 andrew 1428:
1.49 ! andrew 1429: If you pass in a password, it will initalize the database with the encrypted
1.24 andrew 1430: password.
1431:
1.31 andrew 1432: new() now also takes options in other formats
1433:
1434: $pdb = new Palm::Keyring({ key1 => value1, key2 => value2 });
1435: $pdb = new Palm::Keyring( -key1 => value1, -key2 => value2);
1436:
1.38 andrew 1437: =over
1438:
1439: =item Supported options
1.31 andrew 1440:
1441: =over
1442:
1443: =item password
1444:
1445: The password used to initialize the database
1446:
1447: =item version
1448:
1449: The version of database to create. Accepts either 4 or 5. Currently defaults to 4.
1450:
1451: =item cipher
1452:
1.49 ! andrew 1453: The cipher to use. Either the number or the name. Only used by v5 datbases.
1.31 andrew 1454:
1455: 0 => None
1456: 1 => DES_EDE3
1457: 2 => AES128
1458: 3 => AES256
1459:
1460: =item iterations
1461:
1.49 ! andrew 1462: The number of iterations to encrypt with. Only used by somy crypts in v5 databases.
1.37 andrew 1463:
1.31 andrew 1464: =back
1465:
1.38 andrew 1466: =back
1467:
1.36 andrew 1468: For v5 databases there are some additional appinfo fields set.
1.40 andrew 1469: These are set either on new() or Load().
1.36 andrew 1470:
1.37 andrew 1471: $pdb->{appinfo} = {
1472: # normal appinfo stuff described in L<Palm::StdAppInfo>
1473: cipher => The index number of the cipher being used
1474: iter => Number of iterations for the cipher
1475: };
1.36 andrew 1476:
1.43 andrew 1477: =head2 crypts
1.34 andrew 1478:
1479: Pass in the alias of the crypt to use, or the index.
1480:
1.38 andrew 1481: These only make sense for v5 databases.
1482:
1.34 andrew 1483: This is a function, not a method.
1.40 andrew 1484:
1.38 andrew 1485: $cipher can be 0, 1, 2, 3, None, DES_EDE3, AES128 or AES256.
1.34 andrew 1486:
1487: my $c = Palm::Keyring::crypt($cipher);
1488:
1489: $c is now:
1490:
1491: $c = {
1492: alias => (None|DES_EDE3|AES128|AES256),
1493: name => (None|DES_EDE3|Rijndael),
1.44 andrew 1494: keylen => <key length of the cipher>,
1.34 andrew 1495: blocksize => <block size of the cipher>,
1496: default_iter => <default iterations for the cipher>,
1497: };
1498:
1.46 andrew 1499: If it is unable to find the crypt it will return undef.
1500:
1501: =head2 labels
1502:
1.49 ! andrew 1503: Pass in the id or the name of the label. The label id is used as a key
! 1504: to the different parts of the records.
! 1505: See Encrypt() for details on where the label is used.
1.46 andrew 1506:
1507: This is a function, not a method.
1508:
1509: my $l = Palm::Keyring::labels($label);
1510:
1511: $l is now:
1512:
1513: $l = {
1514: id => 0,
1515: name => 'name',
1516: };
1517:
1518: If what you passed in was a number that doesn't have a name, it will return:
1519:
1520: $l => {
1521: id => $num_passed_in,
1522: name => undef,
1523: }
1524:
1525: If you pass in a name that it can't find, then it returns undef.
1526:
1.16 andrew 1527: =head2 Encrypt
1.11 andrew 1528:
1.49 ! andrew 1529: =head3 B<!!! IMPORTANT !!!> The order of the arguments to Encrypt has
! 1530: changed. $password and $plaintext used to be swapped. They changed
! 1531: because you can now set $rec->{plaintext} and not pass in $plaintext so
! 1532: $password is more important.
! 1533:
1.48 andrew 1534: $pdb->Encrypt($rec[, $password[, $plaintext[, $ivec]]]);
1.11 andrew 1535:
1.16 andrew 1536: Encrypts an account into a record, either with the password previously
1537: used, or with a password that is passed.
1.34 andrew 1538:
1539: $ivec is the initialization vector to use to encrypt the record. This is
1540: not used by v4 databases. Normally this is not passed and is generated
1541: randomly.
1.1 andrew 1542:
1.28 andrew 1543: $rec is a record from $pdb->{records} or a new_Record().
1.48 andrew 1544: $rec->{plaintext} is a hashref in the format below.
1.1 andrew 1545:
1.48 andrew 1546: $plaintext = {
1.46 andrew 1547: 0 => {
1548: label => 'name',
1549: label_id => 0,
1550: font => 0,
1551: data => $name,
1552: 1 => {
1553: label => 'account',
1554: label_id => 1,
1555: font => 0,
1556: data => $account,
1557: },
1558: 2 => {
1559: label => 'password',
1560: label_id => 2,
1561: font => 0,
1562: data => $password,
1.20 andrew 1563: },
1.46 andrew 1564: 3 => {
1565: label => 'lastchange',
1566: label_id => 3,
1567: font => 0,
1.49 ! andrew 1568: data => {
! 1569: year => $year, # usually the year - 1900
! 1570: mon => $mon, # range 0-11
! 1571: day => $day, # range 1-31
! 1572: },
1.31 andrew 1573: },
1.46 andrew 1574: 255 => {
1575: label => 'notes',
1576: label_id => 255,
1577: font => 0,
1578: data => $notes,
1.31 andrew 1579: },
1.46 andrew 1580: };
1.31 andrew 1581:
1.49 ! andrew 1582: The account name is stored in $rec->{plaintext}->{0}->{data} for both v4
! 1583: and v5 databases even when the record has not been Decrypt()ed.
1.31 andrew 1584:
1.48 andrew 1585: $rec->{plaintext}->{0} => {
1.47 andrew 1586: label => 'name',
1587: label_id => 0,
1588: font => 0,
1589: data => 'account name',
1.46 andrew 1590: };
1.31 andrew 1591:
1.22 andrew 1592: If you have changed anything other than the lastchange, or don't pass in a
1.24 andrew 1593: lastchange key, Encrypt() will generate a new lastchange date for you.
1.22 andrew 1594:
1595: If you pass in a lastchange field that is different than the one in the
1596: record, it will honor what you passed in.
1597:
1.48 andrew 1598: You can either set $rec->{plaintext} or pass in $plaintext. $plaintext
1599: is used over anything in $rec->{plaintext}.
1600:
1.22 andrew 1601:
1.16 andrew 1602: =head2 Decrypt
1.1 andrew 1603:
1.48 andrew 1604: my $plaintext = $pdb->Decrypt($rec[, $password]);
1.1 andrew 1605:
1.48 andrew 1606: Decrypts the record and returns a reference for the plaintext account as
1.49 ! andrew 1607: described under Encrypt().
1.48 andrew 1608: Also sets $rec->{plaintext} with the same information as $plaintext as
1.49 ! andrew 1609: described in Encrypt().
1.1 andrew 1610:
1.46 andrew 1611: foreach my $rec (@{ $pdb->{records} }) {
1.48 andrew 1612: my $plaintext = $pdb->Decrypt($rec);
1613: # do something with $plaintext
1.16 andrew 1614: }
1.1 andrew 1615:
1.31 andrew 1616:
1.16 andrew 1617: =head2 Password
1.1 andrew 1618:
1.16 andrew 1619: $pdb->Password([$password[, $new_password]]);
1.1 andrew 1620:
1.16 andrew 1621: Either sets the password to be used to crypt, or if you pass $new_password,
1622: changes the password on the database.
1.1 andrew 1623:
1.16 andrew 1624: If you have created a new $pdb, and you didn't set a password when you
1625: called new(), you only need to pass one password and it will set that as
1626: the password.
1.1 andrew 1627:
1.24 andrew 1628: If nothing is passed, it forgets the password that it was remembering.
1.36 andrew 1629:
1630: After a successful password verification the following fields are set
1631:
1632: For v4
1633:
1.37 andrew 1634: $pdb->{digest} = the calculated digest used from the key;
1635: $pdb->{password} = the password that was passed in;
1.46 andrew 1636: $pdb->{encpassword} = the password as stored in the pdb;
1.36 andrew 1637:
1638: For v5
1639:
1.37 andrew 1640: $pdb->{appinfo} = {
1641: # As described under new() with these additional fields
1642: cipher => The index number of the cipher being used
1643: iter => Number of iterations for the cipher
1644: key => The key that is calculated from the password
1645: and salt and is used to decrypt the records.
1646: masterhash => the hash of the key that is stored in the
1647: database. Either set when Loading the database
1648: or when setting a new password.
1649: salt => the salt that is either read out of the database
1650: or calculated when setting a new password.
1651: };
1.1 andrew 1652:
1.48 andrew 1653: =head2 Unlock
1654:
1655: $pdb->Unlock([$password]);
1656:
1657: Decrypts all the records. Sets $rec->{plaintext} for all records.
1658:
1659: This makes it easy to show all decrypted information.
1660:
1661: my $pdb = Palm::KeyRing->new();
1662: $pdb->Load($keyring_file);
1663: $pdb->Unlock($password);
1664: foreach my $plaintext (map { $_->{plaintext} } @{ $pdb->{records} }) {
1665: # Do something like display the account.
1666: }
1667: $pdb->Lock();
1668:
1669: =head2 Lock
1670:
1671: $pdb->Lock();
1672:
1673: Unsets $rec->{plaintext} for all records and unsets the saved password.
1674:
1.49 ! andrew 1675: This does NOT Encrypt() any of the records before clearing them, so if
1.48 andrew 1676: you are not careful you will lose information.
1677:
1678: B<CAVEAT!> This only does "delete $rec->{plaintext}" and the same for the
1679: password. If someone knows of a cross platform reliable way to make
1680: sure that the information is actually cleared from memory I would
1681: appreciate it. Also, if someone knows how to make sure that the stuff
1682: in $rec->{plaintext} is not written to swap, that would be very handy as
1683: well.
1684:
1.43 andrew 1685: =head2 Other overridden subroutines/methods
1686:
1687: =over
1688:
1689: =item ParseAppInfoBlock
1690:
1691: Converts the extra returned by Palm::StdAppInfo::ParseAppInfoBlock() into
1692: the following additions to $pdb->{appinfo}
1693:
1694: $pdb->{appinfo} = {
1695: cipher => The index number of the cipher being used (Not v4)
1696: iter => Number of iterations for the cipher (Not v4)
1697: };
1698:
1699: =item PackAppInfoBlock
1700:
1701: Reverses ParseAppInfoBlock before
1702: sending it on to Palm::StdAppInfo::PackAppInfoBlock()
1703:
1704: =item ParseRecord
1705:
1706: Adds some fields to a record from Palm::StdAppInfo::ParseRecord()
1707:
1708: $rec = {
1709: name => Account name
1710: ivec => The IV for the encrypted record. (Not v4)
1711: encrypted => the encrypted information
1712: };
1.46 andrew 1713:
1714: For v4 databases it also removes record 0 and moves the encrypted password
1715: to $self->{encpassword}.
1.43 andrew 1716:
1717: =item PackRecord
1718:
1719: Reverses ParseRecord and then sends it through Palm::StdAppInfo::PackRecord()
1720:
1.47 andrew 1721: =item Write
1722:
1723: For v4 databases it puts back the record 0 for the encrypted password before
1724: writing it.
1725:
1.43 andrew 1726: =back
1727:
1.14 andrew 1728: =head1 DEPENDENCIES
1.1 andrew 1729:
1.14 andrew 1730: Palm::StdAppInfo
1.1 andrew 1731:
1.41 andrew 1732: B<For v4 databases>
1733:
1.14 andrew 1734: Digest::MD5
1.9 andrew 1735:
1.14 andrew 1736: Crypt::DES
1.4 andrew 1737:
1.41 andrew 1738: B<For v5 databases>
1739:
1740: Digest::HMAC_SHA1
1741:
1742: Digest::SHA1
1743:
1744: Depending on how the database is encrypted
1745:
1746: Crypt::CBC - For any encryption but None
1747:
1.43 andrew 1748: Crypt::DES_EDE3 - DES_EDE3 encryption
1.41 andrew 1749:
1.43 andrew 1750: Crytp::Rijndael - AES encryption schemes
1.10 andrew 1751:
1.24 andrew 1752: =head1 THANKS
1753:
1.47 andrew 1754: I would like to thank the helpful Perlmonk shigetsu who gave me some great
1755: advice and helped me get my first module posted.
1756: L<http://perlmonks.org/?node_id=596998>
1.24 andrew 1757:
1758: I would also like to thank
1759: Johan Vromans
1760: E<lt>jvromans@squirrel.nlE<gt> --
1761: L<http://www.squirrel.nl/people/jvromans>.
1762: He had his own Palm::KeyRing module that he posted a couple of days before
1763: mine was ready and he was kind enough to let me have the namespace as well
1764: as giving me some very helpful hints about doing a few things that I was
1765: unsure of. He is really great.
1.42 andrew 1766:
1767: And finally,
1768: thanks to Jochen Hoenicke E<lt>hoenicke@gmail.comE<gt>
1769: (one of the authors of Palm Keyring)
1770: for getting me started on the v5 support as well as providing help
1771: and some subroutines.
1.24 andrew 1772:
1.14 andrew 1773: =head1 BUGS AND LIMITATIONS
1.43 andrew 1774:
1775: I am sure there are problems with this module. For example, I have
1776: not done very extensive testing of the v5 databases.
1.45 andrew 1777:
1778: I am not sure I am 'require module' the best way, but I don't want to
1779: depend on modules that you don't need to use.
1.43 andrew 1780:
1781: The date validation for packing new dates is very poor.
1782:
1783: I have not gone through and standardized on how the module fails. Some
1784: things fail with croak, some return undef, some may even fail silently.
1.49 ! andrew 1785: Nothing initializes a lasterr method or anything like that.
! 1786:
! 1787: This module does not do anything special with the plaintext data. It SHOULD
! 1788: treat it somehow special so that it can't be found in RAM or in a swap file
! 1789: anywhere. I don't have a clue how to do this.
! 1790:
! 1791: I need to fix all this before it is a 1.0 candidate.
1.1 andrew 1792:
1.14 andrew 1793: Please report any bugs or feature requests to
1794: C<bug-palm-keyring at rt.cpan.org>, or through the web interface at
1795: L<http://rt.cpan.org>. I will be notified, and then you'll automatically be
1796: notified of progress on your bug as I make changes.
1.1 andrew 1797:
1798: =head1 AUTHOR
1799:
1.27 andrew 1800: Andrew Fresh E<lt>andrew@cpan.orgE<gt>
1.1 andrew 1801:
1.14 andrew 1802: =head1 LICENSE AND COPYRIGHT
1803:
1804: Copyright 2004, 2005, 2006, 2007 Andrew Fresh, All Rights Reserved.
1805:
1.15 andrew 1806: This program is free software; you can redistribute it and/or
1807: modify it under the same terms as Perl itself.
1.14 andrew 1808:
1.1 andrew 1809: =head1 SEE ALSO
1810:
1811: Palm::PDB(3)
1812:
1813: Palm::StdAppInfo(3)
1.11 andrew 1814:
1815: The Keyring for Palm OS website:
1816: L<http://gnukeyring.sourceforge.net/>
1.31 andrew 1817:
1818: The HACKING guide for palm keyring databases:
1819: L<http://gnukeyring.cvs.sourceforge.net/*checkout*/gnukeyring/keyring/HACKING>
1.24 andrew 1820:
1821: Johan Vromans also has a wxkeyring app that now uses this module, available
1.27 andrew 1822: from his website at L<http://www.vromans.org/johan/software/sw_palmkeyring.html>
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to Keyring.pm CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [local] / palm / Palm-Keyring / lib / Palm