2 * Claws Mail -- a GTK+ based, lightweight, and fast e-mail client
3 * Copyright (C) 2016 The Claws Mail Team
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 3 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "claws-features.h"
25 #ifdef PASSWORD_CRYPTO_GNUTLS
26 # include <gnutls/gnutls.h>
27 # include <gnutls/crypto.h>
31 #include <glib/gi18n.h>
36 #elif defined G_OS_WIN32
41 #include "common/passcrypt.h"
42 #include "common/plugin.h"
43 #include "common/pkcs5_pbkdf2.h"
44 #include "common/timing.h"
45 #include "common/utils.h"
47 #include "alertpanel.h"
48 #include "inputdialog.h"
50 #include "passwordstore.h"
51 #include "prefs_common.h"
53 #ifndef PASSWORD_CRYPTO_OLD
54 static gchar *_master_passphrase = NULL;
56 /* Length of stored key derivation, before base64. */
59 /* Length of randomly generated and saved salt, used for key derivation.
60 * Also before base64. */
61 #define KD_SALT_LENGTH 64
63 static void _generate_salt()
65 guchar salt[KD_SALT_LENGTH];
67 if (prefs_common_get_prefs()->master_passphrase_salt != NULL) {
68 g_free(prefs_common_get_prefs()->master_passphrase_salt);
71 if (!get_random_bytes(salt, KD_SALT_LENGTH)) {
72 debug_print("Could not get random bytes for kd salt.\n");
76 prefs_common_get_prefs()->master_passphrase_salt =
77 g_base64_encode(salt, KD_SALT_LENGTH);
82 static guchar *_make_key_deriv(const gchar *passphrase, guint rounds,
86 gchar *saltpref = prefs_common_get_prefs()->master_passphrase_salt;
90 /* Grab our salt, generating and saving a new random one if needed. */
91 if (saltpref == NULL || strlen(saltpref) == 0) {
93 saltpref = prefs_common_get_prefs()->master_passphrase_salt;
95 salt = g_base64_decode(saltpref, &saltlen);
96 kd = g_malloc0(length);
98 START_TIMING("PBKDF2");
99 ret = pkcs5_pbkdf2(passphrase, strlen(passphrase), salt, saltlen,
113 const gchar *master_passphrase()
116 gboolean end = FALSE;
118 if (!prefs_common_get_prefs()->use_master_passphrase) {
119 return PASSCRYPT_KEY;
122 if (_master_passphrase != NULL) {
123 debug_print("Master passphrase is in memory, offering it.\n");
124 return _master_passphrase;
128 input = input_dialog_with_invisible(_("Input master passphrase"),
129 _("Input master passphrase"), NULL);
132 debug_print("Cancel pressed at master passphrase dialog.\n");
136 if (master_passphrase_is_correct(input)) {
137 debug_print("Entered master passphrase seems to be correct, remembering it.\n");
138 _master_passphrase = input;
141 alertpanel_error(_("Incorrect master passphrase."));
145 return _master_passphrase;
148 gboolean master_passphrase_is_set()
150 if (prefs_common_get_prefs()->master_passphrase == NULL
151 || strlen(prefs_common_get_prefs()->master_passphrase) == 0)
157 gboolean master_passphrase_is_correct(const gchar *input)
159 guchar *kd, *input_kd;
161 gchar *stored_kd = prefs_common_get_prefs()->master_passphrase;
166 g_return_val_if_fail(stored_kd != NULL && strlen(stored_kd) > 0, FALSE);
167 g_return_val_if_fail(input != NULL, FALSE);
169 if (stored_kd == NULL)
172 tokens = g_strsplit_set(stored_kd, "{}", 3);
173 if (tokens[0] == NULL ||
174 strlen(tokens[0]) != 0 || /* nothing before { */
176 strncmp(tokens[1], "PBKDF2-HMAC-SHA1,", 17) || /* correct tag */
177 strlen(tokens[1]) <= 17 || /* something after , */
178 (rounds = atoi(tokens[1] + 17)) <= 0 || /* valid rounds # */
180 strlen(tokens[2]) == 0) { /* string continues after } */
181 debug_print("Mangled master_passphrase format in config, can not use it.\n");
186 stored_kd = tokens[2];
187 kd = g_base64_decode(stored_kd, &kd_len); /* should be 64 */
190 if (kd_len != KD_LENGTH) {
191 debug_print("master_passphrase is %"G_GSIZE_FORMAT" bytes long, should be %d.\n",
197 input_kd = _make_key_deriv(input, rounds, KD_LENGTH);
198 ret = memcmp(kd, input_kd, kd_len);
209 gboolean master_passphrase_is_entered()
211 return (_master_passphrase == NULL) ? FALSE : TRUE;
214 void master_passphrase_forget()
216 /* If master passphrase is currently in memory (entered by user),
217 * get rid of it. User will have to enter the new one again. */
218 if (_master_passphrase != NULL) {
219 memset(_master_passphrase, 0, strlen(_master_passphrase));
220 g_free(_master_passphrase);
221 _master_passphrase = NULL;
225 void master_passphrase_change(const gchar *oldp, const gchar *newp)
229 guint rounds = prefs_common_get_prefs()->master_passphrase_pbkdf2_rounds;
231 g_return_if_fail(rounds > 0);
234 /* If oldp is NULL, make sure the user has to enter the
235 * current master passphrase before being able to change it. */
236 master_passphrase_forget();
237 oldp = master_passphrase();
239 g_return_if_fail(oldp != NULL);
241 /* Update master passphrase hash in prefs */
242 if (prefs_common_get_prefs()->master_passphrase != NULL)
243 g_free(prefs_common_get_prefs()->master_passphrase);
246 debug_print("Storing key derivation of new master passphrase\n");
247 kd = _make_key_deriv(newp, rounds, KD_LENGTH);
248 base64_kd = g_base64_encode(kd, 64);
249 prefs_common_get_prefs()->master_passphrase =
250 g_strdup_printf("{PBKDF2-HMAC-SHA1,%d}%s", rounds, base64_kd);
254 debug_print("Setting master_passphrase to NULL\n");
255 prefs_common_get_prefs()->master_passphrase = NULL;
258 /* Now go over all accounts, reencrypting their passwords using
259 * the new master passphrase. */
262 oldp = PASSCRYPT_KEY;
264 newp = PASSCRYPT_KEY;
266 debug_print("Reencrypting all account passwords...\n");
267 passwd_store_reencrypt_all(oldp, newp);
269 master_passphrase_forget();
273 gchar *password_encrypt_old(const gchar *password)
275 if (!password || strlen(password) == 0) {
279 gchar *encrypted = g_strdup(password);
280 gchar *encoded, *result;
281 gsize len = strlen(password);
283 passcrypt_encrypt(encrypted, len);
284 encoded = g_base64_encode(encrypted, len);
286 result = g_strconcat("!", encoded, NULL);
292 gchar *password_decrypt_old(const gchar *password)
294 if (!password || strlen(password) == 0) {
298 if (*password != '!' || strlen(password) < 2) {
303 gchar *decrypted = g_base64_decode(password + 1, &len);
305 passcrypt_decrypt(decrypted, len);
309 #ifdef PASSWORD_CRYPTO_GNUTLS
312 /* Since we can't count on having GnuTLS new enough to have
313 * gnutls_cipher_get_iv_size(), we hardcode the IV length for now. */
316 gchar *password_encrypt_gnutls(const gchar *password,
317 const gchar *encryption_passphrase)
319 gnutls_cipher_algorithm_t algo = GNUTLS_CIPHER_AES_256_CBC;
320 gnutls_cipher_hd_t handle;
321 gnutls_datum_t key, iv;
322 int keylen, blocklen, ret, len, i;
323 unsigned char *buf, *encbuf, *base, *output;
324 guint rounds = prefs_common_get_prefs()->master_passphrase_pbkdf2_rounds;
326 g_return_val_if_fail(password != NULL, NULL);
327 g_return_val_if_fail(encryption_passphrase != NULL, NULL);
329 /* ivlen = gnutls_cipher_get_iv_size(algo);*/
330 keylen = gnutls_cipher_get_key_size(algo);
331 blocklen = gnutls_cipher_get_block_size(algo);
332 /* digestlen = gnutls_hash_get_len(digest); */
334 /* Take the passphrase and compute a key derivation of suitable
335 * length to be used as encryption key for our block cipher. */
336 key.data = _make_key_deriv(encryption_passphrase, rounds, keylen);
339 /* Prepare random IV for cipher */
340 iv.data = malloc(IVLEN);
342 if (!get_random_bytes(iv.data, IVLEN)) {
348 /* Initialize the encryption */
349 ret = gnutls_cipher_init(&handle, algo, &key, &iv);
356 /* Find out how big buffer (in multiples of BUFSIZE)
357 * we need to store the password. */
359 len = strlen(password);
360 while(len >= i * BUFSIZE)
364 /* Fill buf with one block of random data, our password, pad the
365 * rest with zero bytes. */
366 buf = malloc(len + blocklen);
367 memset(buf, 0, len + blocklen);
368 if (!get_random_bytes(buf, blocklen)) {
372 gnutls_cipher_deinit(handle);
376 memcpy(buf + blocklen, password, strlen(password));
378 /* Encrypt into encbuf */
379 encbuf = malloc(len + blocklen);
380 memset(encbuf, 0, len + blocklen);
381 ret = gnutls_cipher_encrypt2(handle, buf, len + blocklen,
382 encbuf, len + blocklen);
388 gnutls_cipher_deinit(handle);
393 gnutls_cipher_deinit(handle);
398 /* And finally prepare the resulting string:
399 * "{algorithm,rounds}base64encodedciphertext" */
400 base = g_base64_encode(encbuf, len + blocklen);
402 output = g_strdup_printf("{%s,%d}%s",
403 gnutls_cipher_get_name(algo), rounds, base);
409 gchar *password_decrypt_gnutls(const gchar *password,
410 const gchar *decryption_passphrase)
412 gchar **tokens, *tmp;
413 gnutls_cipher_algorithm_t algo;
414 gnutls_cipher_hd_t handle;
415 gnutls_datum_t key, iv;
416 int keylen, blocklen, ret;
423 g_return_val_if_fail(password != NULL, NULL);
424 g_return_val_if_fail(decryption_passphrase != NULL, NULL);
426 tokens = g_strsplit_set(password, "{}", 3);
428 /* Parse the string, retrieving algorithm and encrypted data.
429 * We expect "{algorithm,rounds}base64encodedciphertext". */
430 if (tokens[0] == NULL || strlen(tokens[0]) != 0 ||
431 tokens[1] == NULL || strlen(tokens[1]) == 0 ||
432 tokens[2] == NULL || strlen(tokens[2]) == 0) {
433 debug_print("Garbled password string.\n");
438 commapos = strcspn(tokens[1], ",");
439 if (commapos == strlen(tokens[1]) || commapos == 0) {
440 debug_print("Garbled algorithm substring.\n");
445 buf = g_strndup(tokens[1], commapos);
446 if ((algo = gnutls_cipher_get_id(buf)) == GNUTLS_CIPHER_UNKNOWN) {
447 debug_print("Password string has unknown algorithm: '%s'\n", buf);
454 if ((rounds = atoi(tokens[1] + commapos + 1)) <= 0) {
455 debug_print("Invalid number of rounds: %d\n", rounds);
460 /* ivlen = gnutls_cipher_get_iv_size(algo); */
461 keylen = gnutls_cipher_get_key_size(algo);
462 blocklen = gnutls_cipher_get_block_size(algo);
463 /* digestlen = gnutls_hash_get_len(digest); */
465 /* Take the passphrase and compute a key derivation of suitable
466 * length to be used as encryption key for our block cipher. */
467 key.data = _make_key_deriv(decryption_passphrase, rounds, keylen);
470 /* Prepare random IV for cipher */
471 iv.data = malloc(IVLEN);
473 if (!get_random_bytes(iv.data, IVLEN)) {
480 /* Prepare encrypted password string for decryption. */
481 tmp = g_base64_decode(tokens[2], &len);
483 if (tmp == NULL || len == 0) {
484 debug_print("Failed base64-decoding of stored password string\n");
491 debug_print("Encrypted password string length: %"G_GSIZE_FORMAT"\n", len);
493 /* Initialize the decryption */
494 ret = gnutls_cipher_init(&handle, algo, &key, &iv);
496 debug_print("Cipher init failed: %s\n", gnutls_strerror(ret));
503 /* Allocate the buffer to store decrypted plaintext in. */
508 ret = gnutls_cipher_decrypt2(handle, tmp, len,
512 debug_print("Decryption failed: %s\n", gnutls_strerror(ret));
516 gnutls_cipher_deinit(handle);
521 gnutls_cipher_deinit(handle);
525 /* 'buf+blocklen' should now be pointing to the plaintext
527 * (The first block contains random data from the IV.)
529 * At this point, it should be a valid UTF-8 string. Let's make sure. */
531 /* First, let's assume there's just garbage and play it safe
532 * by looking for a first NULL byte within the decrypted range.
533 * (We could really use g_strchr_len() here instead, but Glib
534 * doesn't have that.) */
535 if (!g_strstr_len(buf + blocklen, len - blocklen, "\0")) {
536 debug_print("Could not find a NULL byte in the decrypted password.\n");
539 /* There is a NULL byte, we can rely on strlen() returning
540 * a sane value, so we don't read past the end of the allocated
542 valid_utf8 = g_utf8_validate(buf + blocklen, strlen(buf + blocklen), NULL);
546 debug_print("Decrypted password is not a valid UTF-8 string!\n");
547 cm_return_val_if_fail(valid_utf8, NULL);
549 tmp = g_strndup(buf + blocklen, strlen(buf + blocklen));
560 gchar *password_encrypt(const gchar *password,
561 const gchar *encryption_passphrase)
563 if (password == NULL || strlen(password) == 0) {
567 #ifndef PASSWORD_CRYPTO_OLD
568 if (encryption_passphrase == NULL)
569 encryption_passphrase = master_passphrase();
571 return password_encrypt_real(password, encryption_passphrase);
573 return password_encrypt_old(password);
577 gchar *password_decrypt(const gchar *password,
578 const gchar *decryption_passphrase)
580 if (password == NULL || strlen(password) == 0) {
584 /* First, check if the password was possibly decrypted using old,
586 if (*password == '!') {
587 debug_print("Trying to decrypt password using the old method...\n");
588 return password_decrypt_old(password);
591 /* Try available crypto backend */
592 #ifndef PASSWORD_CRYPTO_OLD
593 if (decryption_passphrase == NULL)
594 decryption_passphrase = master_passphrase();
596 if (*password == '{') {
597 debug_print("Trying to decrypt password...\n");
598 return password_decrypt_real(password, decryption_passphrase);
602 /* Fallback, in case the configuration is really old and
603 * stored password in plaintext */
604 debug_print("Assuming password was stored plaintext, returning it unchanged\n");
605 return g_strdup(password);