KWallet format: Support new partially-endianness-unbroken wallets, proper valid(), tunable costs, fix old KDF, support/produce truncated "hashes"

doc/NEWS

@@ -206,7 +206,7 @@ Major changes from 1.9.0-jumbo-1 (May 2019) in this bleeding-edge version:
   uncrackable hashes in the past.  [NecroMortis; 2021]
 
 - Python 3 compatibility and other improvements in various *2john.py scripts
-  [exploide; 2019-2024]
+  [exploide; 2019-2025]
 
 - Add new option --catch-up=NAME, for running a new session only until it
   reaches the candidates tried count of a different, existing and paused
@@ -461,6 +461,15 @@ Major changes from 1.9.0-jumbo-1 (May 2019) in this bleeding-edge version:
 - Added gitea2john.py: Convert Gitea database fields to the pbkdf2-hmac-sha256
   format.  [isaac-app-dev; 2025]
 
+- KWallet format update to support files produced by newer distro builds of
+  KWalletManager with endianness-corrected Blowfish.  [Solar, exploide; 2025]
+
+- KWallet format bug fix of the old KDF (ancient wallets) for password lengths
+  that are multiples of 16 or longer than 48.  [Solar, exploide; 2025]
+
+- KWallet format and kwallet2john.py: Support and produce truncated "hashes"
+  that do not contain the actual encrypted data.  [Solar; 2025]
+
 
 Major changes from 1.8.0-jumbo-1 (December 2014) to 1.9.0-jumbo-1 (May 2019):
 

run/kwallet2john.py

@@ -99,10 +99,20 @@ def process_file(filename):
     encrypted = fd.read(encrypted_size)
     encrypted_size = len(encrypted)
 
-    if encrypted_size % 8 != 0:
-        sys.stderr.write("%s : invalid file structure!\n", filename)
+    if encrypted_size % 8 != 0 or encrypted_size < 88:
+        sys.stderr.write("%s : invalid file structure!\n" % filename)
         sys.exit(7)
 
+    # Don't reveal most of the actual content.  We only need 64 bytes, but
+    # truncate at 65 to avoid false auto-detection as the "leet" format, and
+    # recent John the Ripper knows to expect exactly 65 (or non-truncated).
+    # Comment out the below line if you need a "hash" for an older version of
+    # John the Ripper (before Nov 2025), but please be aware that there were
+    # issues in the KWallet support in those older versions resulting in false
+    # negatives for many kinds of KWallet files and some password lengths, so
+    # this is strongly recommended against.
+    encrypted = encrypted[:65]
+
     if new_version:
         # read salt
         salt_filename = os.path.splitext(filename)[0] + ".salt"