KWallet format fails to crack a test wallet with .salt file #5866
Description
As @exploide reported in #5865, we now have a sample KWallet with a separate .salt file where kwallet2john.py extracts the "hash", but john fails to crack it with the known password openwall. I've confirmed this.
I also found that the extracted "hash" looks very similar to the test vector added by @kholia in 7ef9348, but that one is obviously crackable. It would be great to also have a copy of that wallet itself, @kholia do you still have it?
Experimenting with the new uncrackable wallet further, I found that the endianity conversions probably need to be skipped for such wallets:
memcpy(buffer, cur_salt->ct, cur_salt->ctlen);
/* Blowfish implementation in KWallet is wrong w.r.t endianness
* Well, that is why we had bad_blowfish_plug.c originally ;) */
alter_endianity(buffer, cur_salt->ctlen);
if (cur_salt->kwallet_minor_version == 0) {
BF_set_key(&bf_key, key_size, key);
for (i = 0; i < cur_salt->ctlen; i += 8) {
BF_ecb_encrypt(buffer + i, buffer + i, &bf_key, 0);
}
} else if (cur_salt->kwallet_minor_version == 1) {
unsigned char ivec[8] = { 0 };
key_size = 56;
BF_set_key(&bf_key, key_size, key);
BF_cbc_encrypt(buffer, buffer, cur_salt->ctlen, &bf_key, ivec, 0);
}
alter_endianity(buffer, cur_salt->ctlen);It isn't too surprising that if they had a Blowfish implementation bug, the bug could have been fixed by now. I just wish there's a way to detect that from the wallet file?
Anyway, with both alter_endianity calls above commented out, I am getting sane fsize of 52 (a 32-bit value, so unlikely it'd be this small by chance). And it's the exact same value as for @kholia's test vector, where we have (with alter_endianity still in place):
fsize = 52
testhash : 4f2870ce 42f8a02a 5c0a06f5 b45bd380 7ab1d766
buffer : 1bd15e10 fe4cc73f 00000034 00000012 0046006f 0072006d 00200044 00610074 00610000 00000000 00120050 00610073 00730077 006f0072 00640073 00000000 d9afa799 4f2870ce 42f8a02a 5c0a06f5 b45bd380 7ab1d766
openwall (?)
vs. the new uncrackable wallet (with alter_endianity removed):
fsize = 52
testhash : 4f2870ce 42f8a02a 5c0a06f5 b45bd380 7ab1d766
buffer : a68307c3 f5bff90a 00000034 00000012 0046006f 0072006d 00200044 00610074 00610000 00000000 00120050 00610073 00730077 006f0072 00640073 00000000 aeeaa017 5a7c500b 88764a8d ae1408a4 2583a2d4 87c28ba3
Note that even testhash is the same! I wonder why it would be - maybe because both are empty wallets or something?
Anyway, in the uncrackable wallet this hash value isn't in buffer.