search

keeweb / kdbxweb

Web Kdbx library
https://app.keeweb.info
MIT License
409 stars 57 forks source link

Support Version 3.1 + ChaCha20 #19

Closed subdavis closed 6 years ago

subdavis commented 6 years ago

Hey there! This issue came to my attention from subdavis/Tusk#101. I use kdbxweb in Tusk and have had several user reports of bad behavior.

An awesome bug report finally came from @Gitii, and we concluded that the kdbxweb implementation of ChaCha20 is broken.

Please find attached to this issue a ZIP file containing several KeePass databases. I've tested these all on https://app.keeweb.info and they behave like so.

files.zip

password Encryption Key Transformation Working? KDBX Version
a@b Chacha20 AES No 4
a@b AES Argon2 Yes 4
a@b AES AES Yes 3
a@b Chacha20 Argon2 Yes 4

According to keepassxreboot/keepassxc#1074 using chacha20 for encryption causes a database to be saved as KDBX4, so I believe this is a compatibility issue that keeweb claims to support.

I'm quite motivated to get this fixed very soon. Let me know if there's any additional info you need.

P.S. Thank you for all your hard work. Without this library, my project would not be possible :)

EDIT: Found keeweb/keeweb#705 - I read your final comment, and according to the thread linked above, I don't believe there's any such thing as "kdbx v3 with ChaCha20". I'm going to keep searching for material on this.

EDIT 2: After playing with the code, I see that the commentor above is clearly mistaken. For some unclear reason, the KeePass2 team decoded to introduce ChaCha in v4. While that makes it a pain to support, I think it's important. I'm going to try and take on this work, but I'll gladly accept any guidance.

antelle commented 6 years ago

Hi, This is V3 format with ChaCha20:

format
antelle commented 6 years ago

Added support in v1.1.0, enjoy 😙