2 * Claws Mail -- a GTK+ based, lightweight, and fast e-mail client
3 * Copyright (C) 2016 The Claws Mail Team
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 3 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "claws-features.h"
25 #ifdef PASSWORD_CRYPTO_GNUTLS
26 # include <gnutls/gnutls.h>
27 # include <gnutls/crypto.h>
31 #include <glib/gi18n.h>
36 #elif defined G_OS_WIN32
41 #include "common/passcrypt.h"
42 #include "common/plugin.h"
43 #include "common/utils.h"
45 #include "alertpanel.h"
46 #include "inputdialog.h"
48 #include "passwordstore.h"
49 #include "prefs_common.h"
51 #ifndef PASSWORD_CRYPTO_OLD
52 static gchar *_master_passphrase = NULL;
54 static const gchar *master_passphrase()
59 if (!prefs_common_get_prefs()->use_master_passphrase) {
63 if (_master_passphrase != NULL) {
64 debug_print("Master passphrase is in memory, offering it.\n");
65 return _master_passphrase;
69 input = input_dialog_with_invisible(_("Input master passphrase"),
70 _("Input master passphrase"), NULL);
73 debug_print("Cancel pressed at master passphrase dialog.\n");
77 if (master_passphrase_is_correct(input)) {
78 debug_print("Entered master passphrase seems to be correct, remembering it.\n");
79 _master_passphrase = input;
82 alertpanel_error(_("Incorrect master passphrase."));
86 return _master_passphrase;
89 const gboolean master_passphrase_is_set()
91 if (prefs_common_get_prefs()->master_passphrase_hash == NULL
92 || strlen(prefs_common_get_prefs()->master_passphrase_hash) == 0)
98 const gboolean master_passphrase_is_correct(const gchar *input)
102 gchar *stored_hash = prefs_common_get_prefs()->master_passphrase_hash;
103 const GChecksumType hashtype = G_CHECKSUM_SHA256;
104 const gssize hashlen = g_checksum_type_get_length(hashtype);
107 g_return_val_if_fail(input != NULL, FALSE);
109 if (stored_hash == NULL)
112 tokens = g_strsplit_set(stored_hash, "{}", 3);
113 if (strlen(tokens[0]) != 0 ||
114 strcmp(tokens[1], "SHA-256") ||
115 strlen(tokens[2]) == 0) {
116 debug_print("Mangled master_passphrase_hash in config, can not use it.\n");
121 stored_hash = tokens[2];
122 stored_len = strlen(stored_hash);
123 g_return_val_if_fail(stored_len == 2*hashlen, FALSE);
125 hash = g_compute_checksum_for_string(hashtype, input, -1);
127 if (!strncasecmp(hash, stored_hash, stored_len)) {
138 gboolean master_passphrase_is_entered()
140 return (_master_passphrase == NULL) ? FALSE : TRUE;
143 void master_passphrase_forget()
145 /* If master passphrase is currently in memory (entered by user),
146 * get rid of it. User will have to enter the new one again. */
147 if (_master_passphrase != NULL) {
148 memset(_master_passphrase, 0, strlen(_master_passphrase));
149 g_free(_master_passphrase);
150 _master_passphrase = NULL;
154 void master_passphrase_change(const gchar *oldp, const gchar *newp)
156 const GChecksumType hashtype = G_CHECKSUM_SHA256;
160 /* If oldp is NULL, make sure the user has to enter the
161 * current master passphrase before being able to change it. */
162 master_passphrase_forget();
163 oldp = master_passphrase();
165 g_return_if_fail(oldp != NULL);
167 /* Update master passphrase hash in prefs */
168 if (prefs_common_get_prefs()->master_passphrase_hash != NULL)
169 g_free(prefs_common_get_prefs()->master_passphrase_hash);
172 debug_print("Storing hash of new master passphrase\n");
173 hash = g_compute_checksum_for_string(hashtype, newp, -1);
174 prefs_common_get_prefs()->master_passphrase_hash =
175 g_strconcat("{SHA-256}", hash, NULL);
178 debug_print("Setting master_passphrase_hash to NULL\n");
179 prefs_common_get_prefs()->master_passphrase_hash = NULL;
182 /* Now go over all accounts, reencrypting their passwords using
183 * the new master passphrase. */
186 oldp = PASSCRYPT_KEY;
188 newp = PASSCRYPT_KEY;
190 debug_print("Reencrypting all account passwords...\n");
191 passwd_store_reencrypt_all(oldp, newp);
193 /* Now reencrypt all plugins passwords fields
194 * FIXME: Unloaded plugins won't be able to update their stored passwords
196 plugins_master_passphrase_change(oldp, newp);
198 master_passphrase_forget();
202 gchar *password_encrypt_old(const gchar *password)
204 if (!password || strlen(password) == 0) {
208 gchar *encrypted = g_strdup(password);
209 gchar *encoded, *result;
210 gsize len = strlen(password);
212 passcrypt_encrypt(encrypted, len);
213 encoded = g_base64_encode(encrypted, len);
215 result = g_strconcat("!", encoded, NULL);
221 gchar *password_decrypt_old(const gchar *password)
223 if (!password || strlen(password) == 0) {
227 if (*password != '!' || strlen(password) < 2) {
232 gchar *decrypted = g_base64_decode(password + 1, &len);
234 passcrypt_decrypt(decrypted, len);
238 #ifdef PASSWORD_CRYPTO_GNUTLS
241 /* Since we can't count on having GnuTLS new enough to have
242 * gnutls_cipher_get_iv_size(), we hardcode the IV length for now. */
245 gchar *password_encrypt_gnutls(const gchar *password,
246 const gchar *encryption_passphrase)
248 /* Another, slightly inferior combination is AES-128-CBC + SHA-256.
249 * Any block cipher in CBC mode with keysize N and a hash algo with
250 * digest length 2*N would do. */
251 gnutls_cipher_algorithm_t algo = GNUTLS_CIPHER_AES_256_CBC;
252 gnutls_digest_algorithm_t digest = GNUTLS_DIG_SHA512;
253 gnutls_cipher_hd_t handle;
254 gnutls_datum_t key, iv;
255 int keylen, digestlen, blocklen, ret, i;
256 unsigned char hashbuf[BUFSIZE], *buf, *encbuf, *base, *output;
257 #if defined G_OS_UNIX
259 #elif defined G_OS_WIN32
263 g_return_val_if_fail(password != NULL, NULL);
264 g_return_val_if_fail(encryption_passphrase != NULL, NULL);
266 /* ivlen = gnutls_cipher_get_iv_size(algo);*/
267 keylen = gnutls_cipher_get_key_size(algo);
268 blocklen = gnutls_cipher_get_block_size(algo);
269 digestlen = gnutls_hash_get_len(digest);
271 /* Prepare key for cipher - first half of hash of passkey XORed with
273 memset(&hashbuf, 0, BUFSIZE);
274 if ((ret = gnutls_hash_fast(digest, encryption_passphrase,
275 strlen(encryption_passphrase), &hashbuf)) < 0) {
276 debug_print("Hashing passkey failed: %s\n", gnutls_strerror(ret));
279 for (i = 0; i < digestlen/2; i++) {
280 hashbuf[i] = hashbuf[i] ^ hashbuf[i+digestlen/2];
283 key.data = malloc(keylen);
284 memcpy(key.data, &hashbuf, keylen);
287 /* Prepare our source of random data. */
288 #if defined G_OS_UNIX
289 rnd = open("/dev/urandom", O_RDONLY);
291 perror("fopen on /dev/urandom");
292 #elif defined G_OS_WIN32
293 if (!CryptAcquireContext(&rnd, NULL, NULL, PROV_RSA_FULL, 0) &&
294 !CryptAcquireContext(&rnd, NULL, NULL, PROV_RSA_FULL, CRYPT_NEWKEYSET)) {
295 debug_print("Could not acquire a CSP handle.\n");
302 /* Prepare random IV for cipher */
303 iv.data = malloc(IVLEN);
305 #if defined G_OS_UNIX
306 ret = read(rnd, iv.data, IVLEN);
308 perror("read into iv");
310 #elif defined G_OS_WIN32
311 if (!CryptGenRandom(rnd, IVLEN, iv.data)) {
312 debug_print("Could not read random data for IV\n");
313 CryptReleaseContext(rnd, 0);
320 /* Initialize the encryption */
321 ret = gnutls_cipher_init(&handle, algo, &key, &iv);
325 #if defined G_OS_UNIX
327 #elif defined G_OS_WIN32
328 CryptReleaseContext(rnd, 0);
333 /* Fill buf with one block of random data, our password, pad the
334 * rest with zero bytes. */
335 buf = malloc(BUFSIZE + blocklen);
336 memset(buf, 0, BUFSIZE);
337 #if defined G_OS_UNIX
338 ret = read(rnd, buf, blocklen);
339 if (ret != blocklen) {
340 perror("read into buffer");
342 #elif defined G_OS_WIN32
343 if (!CryptGenRandom(rnd, blocklen, buf)) {
344 debug_print("Could not read random data for IV\n");
345 CryptReleaseContext(rnd, 0);
350 gnutls_cipher_deinit(handle);
354 /* We don't need any more random data. */
355 #if defined G_OS_UNIX
357 #elif defined G_OS_WIN32
358 CryptReleaseContext(rnd, 0);
361 memcpy(buf + blocklen, password, strlen(password));
363 /* Encrypt into encbuf */
364 encbuf = malloc(BUFSIZE + blocklen);
365 memset(encbuf, 0, BUFSIZE + blocklen);
366 ret = gnutls_cipher_encrypt2(handle, buf, BUFSIZE + blocklen,
367 encbuf, BUFSIZE + blocklen);
373 gnutls_cipher_deinit(handle);
378 gnutls_cipher_deinit(handle);
383 /* And finally prepare the resulting string:
384 * "{algorithm}base64encodedciphertext" */
385 base = g_base64_encode(encbuf, BUFSIZE);
387 output = g_strdup_printf("{%s}%s", gnutls_cipher_get_name(algo), base);
393 gchar *password_decrypt_gnutls(const gchar *password,
394 const gchar *decryption_passphrase)
396 gchar **tokens, *tmp;
397 gnutls_cipher_algorithm_t algo;
398 gnutls_digest_algorithm_t digest = GNUTLS_DIG_UNKNOWN;
399 gnutls_cipher_hd_t handle;
400 gnutls_datum_t key, iv;
401 int keylen, digestlen, blocklen, ret, i;
403 unsigned char hashbuf[BUFSIZE], *buf;
404 #if defined G_OS_UNIX
406 #elif defined G_OS_WIN32
410 g_return_val_if_fail(password != NULL, NULL);
411 g_return_val_if_fail(decryption_passphrase != NULL, NULL);
413 tokens = g_strsplit_set(password, "{}", 3);
415 /* Parse the string, retrieving algorithm and encrypted data.
416 * We expect "{algorithm}base64encodedciphertext". */
417 if (strlen(tokens[0]) != 0 ||
418 (algo = gnutls_cipher_get_id(tokens[1])) == GNUTLS_CIPHER_UNKNOWN ||
419 strlen(tokens[2]) == 0)
422 /* Our hash algo needs to have digest length twice as long as our
423 * cipher algo's key length. */
424 if (algo == GNUTLS_CIPHER_AES_256_CBC) {
425 debug_print("Using AES-256-CBC + SHA-512 for decryption\n");
426 digest = GNUTLS_DIG_SHA512;
427 } else if (algo == GNUTLS_CIPHER_AES_128_CBC) {
428 debug_print("Using AES-128-CBC + SHA-256 for decryption\n");
429 digest = GNUTLS_DIG_SHA256;
431 if (digest == GNUTLS_DIG_UNKNOWN) {
432 debug_print("Password is encrypted with unsupported cipher, giving up.\n");
437 /* ivlen = gnutls_cipher_get_iv_size(algo); */
438 keylen = gnutls_cipher_get_key_size(algo);
439 blocklen = gnutls_cipher_get_block_size(algo);
440 digestlen = gnutls_hash_get_len(digest);
442 /* Prepare key for cipher - first half of hash of passkey XORed with
443 * the second. AES-256 has key length 32 and length of SHA-512 hash
444 * is exactly twice that, 64. */
445 memset(&hashbuf, 0, BUFSIZE);
446 if ((ret = gnutls_hash_fast(digest, decryption_passphrase,
447 strlen(decryption_passphrase), &hashbuf)) < 0) {
448 debug_print("Hashing passkey failed: %s\n", gnutls_strerror(ret));
452 for (i = 0; i < digestlen/2; i++) {
453 hashbuf[i] = hashbuf[i] ^ hashbuf[i+digestlen/2];
456 key.data = malloc(keylen);
457 memcpy(key.data, &hashbuf, keylen);
460 /* Prepare our source of random data. */
461 #if defined G_OS_UNIX
462 rnd = open("/dev/urandom", O_RDONLY);
464 perror("fopen on /dev/urandom");
465 #elif defined G_OS_WIN32
466 if (!CryptAcquireContext(&rnd, NULL, NULL, PROV_RSA_FULL, 0) &&
467 !CryptAcquireContext(&rnd, NULL, NULL, PROV_RSA_FULL, CRYPT_NEWKEYSET)) {
468 debug_print("Could not acquire a CSP handle.\n");
476 /* Prepare random IV for cipher */
477 iv.data = malloc(IVLEN);
479 #if defined G_OS_UNIX
480 ret = read(rnd, iv.data, IVLEN);
482 perror("read into iv");
484 #elif defined G_OS_WIN32
485 if (!CryptGenRandom(rnd, IVLEN, iv.data)) {
486 debug_print("Could not read random data for IV\n");
487 CryptReleaseContext(rnd, 0);
495 /* We don't need any more random data. */
496 #if defined G_OS_UNIX
498 #elif defined G_OS_WIN32
499 CryptReleaseContext(rnd, 0);
502 /* Prepare encrypted password string for decryption. */
503 tmp = g_base64_decode(tokens[2], &len);
506 /* Initialize the decryption */
507 ret = gnutls_cipher_init(&handle, algo, &key, &iv);
509 debug_print("Cipher init failed: %s\n", gnutls_strerror(ret));
515 buf = malloc(BUFSIZE + blocklen);
516 memset(buf, 0, BUFSIZE + blocklen);
517 ret = gnutls_cipher_decrypt2(handle, tmp, len,
518 buf, BUFSIZE + blocklen);
520 debug_print("Decryption failed: %s\n", gnutls_strerror(ret));
524 gnutls_cipher_deinit(handle);
529 gnutls_cipher_deinit(handle);
533 tmp = g_strndup(buf + blocklen, MIN(strlen(buf + blocklen), BUFSIZE));
542 gchar *password_encrypt(const gchar *password,
543 const gchar *encryption_passphrase)
545 if (password == NULL || strlen(password) == 0) {
549 #ifndef PASSWORD_CRYPTO_OLD
550 if (encryption_passphrase == NULL)
551 encryption_passphrase = master_passphrase();
553 return password_encrypt_real(password, encryption_passphrase);
556 return password_encrypt_old(password);
559 gchar *password_decrypt(const gchar *password,
560 const gchar *decryption_passphrase)
562 if (password == NULL || strlen(password) == 0) {
566 /* First, check if the password was possibly decrypted using old,
568 if (*password == '!') {
569 debug_print("Trying to decrypt password using the old method...\n");
570 return password_decrypt_old(password);
573 /* Try available crypto backend */
574 #ifndef PASSWORD_CRYPTO_OLD
575 if (decryption_passphrase == NULL)
576 decryption_passphrase = master_passphrase();
578 if (*password == '{') {
579 debug_print("Trying to decrypt password...\n");
580 return password_decrypt_real(password, decryption_passphrase);
584 /* Fallback, in case the configuration is really old and
585 * stored password in plaintext */
586 debug_print("Assuming password was stored plaintext, returning it unchanged\n");
587 return g_strdup(password);