| Subject: | Integer overflow bug in salsa20 implementation |
| Date: | Wed, 09 Jan 2013 11:26:03 +0000 |
| To: | bug-File-KeePass [...] rt.cpan.org |
| From: | "Radu Hociung" <radu [...] ohmi.org> |
Hello,
The File::KeePass module uses a salsa20 stream crypt implementation to
protect the password field when stored in KeePass v2/kdbx database
files.
However, at the current version, 2.03, all passwords stored in v2
databases are not recoverable with File::KeePass. Also, passwords that
the module writes to kdbx databases are not readable by the KeePass
application (they appear garbled in KeePass).
I looked into the problem, and I found the cause is that the arithmetic
addition operation in the salsa20 implementation saturates to
0xffffffff in perl, while the algorithm specification expects it to
wrap around.
I have a temporary workaround, but I don't believe it's correct for
64-bit as well as 32-bit perls. Also building the module for CentOS
with cpanspec and the enclosed patch warns that my fix is not portable.
However, the patched build works correctly on my 32-bit system
The fix does this substitution wherever "& 0xffffffff" occurs.
Apparently modulo 0x1_0000_0000 works correctly:
- $x[ 4] ^= $rotl32->(($x[ 0] + $x[12]) & 0xffffffff, 7);
+ $x[ 4] ^= $rotl32->(($x[ 0] + $x[12]) % 0x100000000, 7);
I tested this on "perl, v5.10.1 (*) built for i386-linux-thread-multi"
Please find enclosed the patch I used, as well as two simplified
scripts with and without the fix, that attempt to generate a few
test-vectors from
http://www.ecrypt.eu.org/stream/svn/viewcvs.cgi/ecrypt/trunk/submissions/salsa20/full/verified.test-vectors
The file
"salsa20-perl-integer-overflow/salsa20-with-integer-overflow.pl" shows
wrong output and "salsa20-perl-integer-overflow/salsa20-correct.pl"
shows correct output, matching the test-vectors from ecrypt.
I am not a perl expert and I don't know how to properly fix the
arithmetic overflow, but I trust you will be able to find a fix that
works on all platforms.
If I can help further, please don't hesitate to contact me.
Regards
Radu Hociung
radu.cpan-file-keepass@ohmi.org
Message body not shown because it is not plain text.