Sharing credentials between phone client & pwdsphinx client doesn't work for me #8
Comments
|
You used |
|
Ah, thanks for the quick hint. Unfortunately, this doesn't seem to fix my issue. By the way, the other way around doesn't work neither: I can add user/site from the cli and cannot access it from the android app ("a server error occurred"). The app doesn't show me the created accounts. Also, from the cli, I cannot add accounts to the same site ("site") I used in the android app. |
|
Which versions (release version or commit hash) of pwdsphinx and Androsphinx are you using? Also, take a look at the conformance test suite (see README) which runs tests exactly like these, maybe that could help you debug on your side. |
|
Hi, I'm using pwdsphinx b0518878dc31f27d555becb9e5ed8056564da11d and androsphinx 0bf34e1. I only compiled the app using gradle (i.e. without even accessing any GUI like Android Studio). I will have to check whether I can reproduce the issue with the test suite. |
|
ok. did you somehow copy over from host/phone the masterkey to the other device? if not that explains it. and there is an untagged version of pwdsphinx which allows to export the masterkey using a qrcode that can be conveniently read in by androsphinx. |
|
HI @stef , thanks for commenting here, too. I have a development machine and a phone. I run the pwdsphinx oracle process and the pwdsphinx client process (sphinx.py) on the development machine. The master key is also on that machine. I used the qr code instructions to generate the QR code. I used the barcode scanner on the phone to read that code. I did not copy any file to the phone. |
that should be fine, thanks for confirming that you indeed probably have the same keys on both devices (PC and phone) |
|
aah. great. thanks. let's dig deeper then. |
|
would you also be able to tell us which git revision of libsphinx you use on your host? |
|
if you use the latest release of libsphinx, then this is my fault, i should do a new release, because since 2018 we had some changes that might be significant: https://github.com/stef/libsphinx/commits/master/src/sphinx.c |
|
i actually just tagged v0.11 for libsphinx |
|
Thanks for the many replies: I use https://github.com/stef/libsphinx/commits/51b0c18c94b645bd7ea3bb21aef623318e0b7939 |
|
hrmpf, that seems like a very good choice, however it gets us back to square one. let me figure out something. sorry for the inconvenience! |
|
let's look at this methodically
this is obviously ok. looking at the code it seems this is the only place that can trigger such a message without a traceback: https://github.com/stef/pwdsphinx/blob/b0518878dc31f27d555becb9e5ed8056564da11d/pwdsphinx/sphinx.py#L159 which means the rules blob encrypted by the phone cannot be decrypted by the host. this looks ok, and seems to behave as expected. this clearly says, that when creating the new entry, the client wants to update the list of usernames associated with this host, and the record returned by the server cannot be decrypted by the client. so for some reason the blob encrypted by the phone cannot be decrypted by the client on the host. so looking at the two causes above it seems that the decryption does not work the same way on the phone and the host. the decryption function is quite simple: def decrypt_blob(blob, rwd):
# todo implement padding
sk = get_sealkey(rwd)
nonce = blob[:pysodium.crypto_secretbox_NONCEBYTES]
blob = blob[pysodium.crypto_secretbox_NONCEBYTES:]
res = pysodium.crypto_secretbox_open(blob,nonce,sk)
clearmem(sk)
return resthis is called from the blob = decrypt_blob(blob, b'')similarly, the let's have a look at def get_sealkey(rwd):
mk = get_masterkey()
sk = pysodium.crypto_generichash(ENC_CTX, mk)
clearmem(mk)
# rehash with rwd so the user always contributes his pwd and the sphinx server it's seed
if rwd_keys:
sk = pysodium.crypto_generichash(sk, rwd)
return sklooking at your screenshot in the first comment on this thread, it seems fun Protocol.CredentialStore.getSealKey(rwd: ByteArray = ByteArray(0)): SecretBoxKey =
SecretBoxKey.fromByteArray(key.foldHash(Context.ENCRYPTION, rwd))My kotlin-fu is basically non-existant but it looks like the masterkey is not contributing to the |
However, thinking all this through leads me to believe that in case no |
|
i simplified def get_sealkey():
mk = get_masterkey()
sk = pysodium.crypto_generichash(ENC_CTX, mk)
clearmem(mk)
return skhere's the full commit: stef/pwdsphinx@7480e7b |
- removed empty rwd from seal key - made rwd optional depending on boolean flag - probably the root cause of gh-8
|
@dnet @stef thanks a lot for your efforts. It works fine now! I can share the credentials between pwdsphinx cli client and androsphinx (in both directions). I was not sure whether I needed to supply Awesome! |
|
hey, thank you rolf! for packaging, testing, reporting and your patience! <3 |
This is only needed when using the (non-default) |
Hi,
I managed to compile & run the software on my phone.
I also setup an oracle server (from https://github.com/stef/pwdsphinx). The pwdsphinx server works fine on my local machine (i.e. I can run the oracle process and access it using the python sphinx.py client). I have used these commands here stef/pwdsphinx#9 to generate the ssl certificate.
Here's a picture of pwdshinx working fine locally:
(The ip address provided in the config is the one of my development maschine. The logged request on the left comes from the client on the right.)
Here's a picture of androsphinx using my phone:
Here is my actual problem. Below you'll see two requests. The first is from my phone and it works just fine. Requesting the same site/user information using the local client doesn't work (2nd request on the left, 'fail' on the right). I was expecting to be able to fetch from one client what the other client had sent to the server before.
Requesting a different user/site combination from the pwdsphinx client yields an exception, so the user/site params are correct. I just don't get the password back. I verified the master password. I guess I am doing something wrong but I don't know what...
The text was updated successfully, but these errors were encountered: