API tools faq
paste
Advertisement
krot

Netscape Communicator Key Database Format

krot
Mar 20th, 2020
1,191
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 9.18 KB | None | 0 0
raw download clone embed print report
  1. Netscape Communicator Key Database Format.
  2. Introduction.
  3. Firstly a bit of background.
  4.  
  5. I discovered the format of the Netscape communicator private key database some time ago. Since then I've been asked from time to time for more details. Since this information isn't usually needed and there were some security concerns I have not revealed this information until now, also it took a considerable amount of work to determine the format used.
  6.  
  7. Since then some things have changed. Firstly the number of requests has increased enormously and secondly Netscape have themselves released code to access their databases, this is now part of the open source NSS library in the Mozilla project. Check the Mozilla web site for more information, including an official description of the key derivation algorithm.
  8.  
  9. This information was used to in some database access code I wrote for Celo Communications and they have kindly permitted me to make the details public.
  10.  
  11. This information relates to the format used by Communicator 4.X, 4.5X and 4.7X. Older Netscape servers and version 3.0 of Navigator use a different format: information about this format will be made available in due course.
  12. Basic Details.
  13. The Netscape key database is contained in a file called key3.db. Like the certificate database it is in Berkeley DB 1.85 hash format, see the certificate database page for more information.
  14. Record Structure.
  15. There are four different types of record. A version entry, a global salt entry, a password check entry and zero or more private key entries. If the database is newly created then it will have no private key entries at all. Note: the database will have a hybrid format if it is newly converted from Netscape Communicator 3.0, it will stay in this format until the first time the password is entered (since this is needed to read the entries), then it will be converted to 4.0 format.
  16.  
  17. These entries are distinguished by their database keys. They are described in more detail below.
  18. Version entry.
  19. This entry has the 7 byte ASCII string Version as its key, not null terminated. It is used for version information and consists of the single byte 0x3 in the versions I tested.
  20. Global Salt.
  21. This is an entry with the 11 byte key global-salt again not null terminated. It is used to derive the decryption keys from passwords. It's value is 16 bytes long.
  22. Password Check.
  23. This entry has the 14 byte key password-check.
  24.  
  25. Here is a sample value:
  26.  
  27. 0000 03 10 01 15 96 bb 81 12 65 2a 43 e7 bd fb 2f dc |........e*C.../.|
  28. 0010 87 99 e5 00 0b 2a 86 48 86 f7 0d 01 0c 05 01 03 |.....*.H........|
  29. 0020 c0 84 68 48 fe 6e 35 24 fd d4 a6 e3 e7 83 cf 38 |..hH.n5$.......8|
  30.  
  31. The first three bytes are header information. This is followed by an entry salt the length of which is specified in the second byte.
  32. In this example the entry salt is of length 0x10 and starts with the value 0x15.
  33.  
  34. The last 16 bytes is the string password-check encrypted using triple DES in CBC mode and standard block padding. The key used is derived from the global salt and the entry salt. By checking that this entry can be decrypted correctly the password can be checked.
  35.  
  36. [Side note: I was a little disappointed when I found out what was encrypted here. I was expecting some insulting comment about MSIE :-)]
  37. Private Key entries.
  38. The private key entries has a database key that is part of the public key, for an RSA key it is the modulus, for a DSA key it is the public value both are represented as big endian numbers in ASN1 format. That is an extra zero byte is prepended if the first byte is 0x80 or more.
  39.  
  40. Here is a sample value:
  41.  
  42. 0000 03 08 05 3f 29 2b 8e 17 15 64 76 74 65 73 74 00 |...?)+...dvtest.|
  43. 0010 30 82 01 82 30 1c 06 0b 2a 86 48 86 f7 0d 01 0c |0...0...*.H.....|
  44. 0020 05 01 03 30 0d 04 08 3f 29 2b 8e 17 15 64 76 02 |...0...?)+...dv.|
  45. [remaining data omitted]
  46.  
  47. The first three bytes are header information. Following it is an entry salt whose length is given by the second byte. In this case it is of length 0x08 and consists of the bytes: 0x3f through 0x76. Following this is the name of the certificate (which may be empty) which appears in the list box as a null terminated ASCII string, the length of this is given by the third byte. In this example it is "test". The remainder of the entry is the private key itself.
  48.  
  49. The private key is in PKCS#8 format and looks like this for the example above.
  50.  
  51. 16 30 386: SEQUENCE {
  52. 20 30 28: SEQUENCE {
  53. 22 06 11: OBJECT IDENTIFIER
  54. : pkcs-12-PBEWithSha1AndTripleDESCBC (1 2 840 113549 1 12 5 1 3)
  55. 35 30 13: SEQUENCE {
  56. 37 04 8: OCTET STRING
  57. : 3F 29 2B 8E 17 15 64 76
  58. 47 02 1: INTEGER 1
  59. : }
  60. : }
  61. 50 04 352: OCTET STRING
  62. : 70 33 C0 A1 CD 50 CA 39 56 3A B0 ED 3D 46 6B 75
  63. : A7 5A B7 A5 9F 9A D7 45 25 EC 12 2E 41 4D 51 58
  64. : 29 FC 43 72 67 C9 36 10 10 0F 1C 54 00 4E 66 3D
  65. : C1 63 7F F9 D6 5F 0E D4 9F D1 5E 0C 24 EB DA FF
  66. : D5 41 D9 A0 F9 81 8D BD BA EA E9 19 3E 58 A0 EA
  67. : AF A5 B9 03 EE 90 8F A1 B7 ED 7E 4E 28 67 38 89
  68. : 65 CB 17 DB 00 0E 2A 37 42 AD 8D BA F5 3A FD ED
  69. : B2 53 A2 5A D2 B0 0C 7E F9 01 E1 50 15 B9 A2 FC
  70. : [ Another 224 bytes skipped ]
  71. : }
  72.  
  73. The AlgorithmIdentifier used here is a PKCS#5 PBEParameter structure. The more observant may recognize the salt: it is exactly the same as the entry salt. The object identifier representing the algorithm is one of the original PFX ones: but the key derivation algorithm is different. The encryption algorithm is triple DES in CBC mode with standard block padding.
  74.  
  75. The decrypted private key is, as might be expected, a PKCS#8 PrivateKeyInfo structure. However it is non standard for DSA keys: the privateKey contents is an ASN1 SEQUENCE consisting of the private and public keys respectively expressed as ASN1 INTEGERs, rather than the standard single INTEGER containing the private key. I suppose when this stuff was written there wasn't a PKCS#8 DSA standard (which is currently well hidden in PKCS#11).
  76. Key Derivation Algorithm.
  77. This is of course all very well but it is useless if you can't decrypt the private key entries. The key derivation algorithm is a very peculiar beast, AFAIK it is a Netscape invention used for nothing else. This description has been independently implemented and verified by several people so I'm pretty sure it is accurate.
  78.  
  79. Anyway here is the info.
  80.  
  81. Initially you will need the database password, this is represented as an ASCII string: the null terminator is not included in any operations.
  82.  
  83. Form the hashed password HP:
  84.  
  85. HP = SHA1(global-salt||password).
  86.  
  87. Note: at this point the password can be deleted from memory: this avoids having to keep plaintext passwords in memory. All operations can be done just using HP.
  88.  
  89. Call the entry salt ES. Now append zero bytes to ES until the result is 20 bytes long to form a padded entry salt PES.
  90.  
  91. Form a combined hashed password CHP:
  92.  
  93. CHP = SHA1(HP||ES)
  94.  
  95. Now it gets a bit more complicated. The following operations use an SHA1 HMAC using CHP as the key. This will be represented as CHMAC(text)
  96.  
  97. Form the key k1:
  98.  
  99. k1 = CHMAC(PES||ES)
  100.  
  101. Form the temporary key tk:
  102.  
  103. tk = CHMAC(PES)
  104.  
  105. Form the key k2 using:
  106.  
  107. k2 = CHMAC(tk||ES)
  108.  
  109. Finally form the 40 byte key k:
  110.  
  111. k = k1||k2
  112.  
  113. The first 24 bytes of k are used to form a 3DES key and the the last 8 bytes are used for the IV.
  114.  
  115. That's the complete key derivation algorithm, you're probably as surprised as I am that this wasn't guessed before :-)
  116. Security Concerns.
  117. As with many password based encryption schemes there are security concerns. In this case the main concern is that the algorithm does not have a high iteration count. This makes dictionary attacks on the password possible.
  118. Test Vectors.
  119. I'll take pity of those that may have to implement this algorithm and provide some test vectors. Here is a sample session on decrypting the password-check entry from the example above. The password is the 8 character string "password" (without the quotes). All output is in hex.
  120.  
  121. The password is:
  122. 70 61 73 73 77 6f 72 64
  123.  
  124. The global salt is:
  125. 5a ac 8e 04 39 e8 d6 9e a0 fe 1b c0 13 cd 5a f8
  126.  
  127. The entry salt ES is:
  128. 15 96 bb 81 12 65 2a 43 e7 bd fb 2f dc 87 99 e5
  129.  
  130. And the data to be decrypted is:
  131. c0 84 68 48 fe 6e 35 24 fd d4 a6 e3 e7 83 cf 38
  132.  
  133. Now the actual results:
  134.  
  135. PES = 15 96 bb 81 12 65 2a 43 e7 bd fb 2f dc 87 99 e5 00 00 00 00
  136. HP = 57 f3 86 39 12 8e 14 89 1b 18 51 8f 63 be c6 cb 56 73 82 77
  137. CHP = 8e 1e 3a 52 36 ab c3 44 55 2d 6e 1a 00 67 1a ed 69 2d 48 25
  138. k1 = 16 74 39 40 5b 76 bd cb 62 ea b2 1a 71 e5 59 12 9c f2 cb 6d
  139. tk = c3 34 9d 3c ec 3e 83 55 62 4c af 06 f2 6b 69 bc 17 0a 21 0e
  140. k2 = 4d c5 0b 9c ad f1 53 78 a0 bc 86 11 90 75 b3 de 65 c7 d8 a7
  141. k = 16 74 39 40 5b 76 bd cb 62 ea b2 1a 71 e5 59 12 9c f2 cb 6d
  142. 4d c5 0b 9c ad f1 53 78 a0 bc 86 11 90 75 b3 de 65 c7 d8 a7
  143. key = 16 74 39 40 5b 76 bd cb 62 ea b2 1a 71 e5 59 12 9c f2 cb 6d 4d c5 0b 9c
  144. iv = 90 75 b3 de 65 c7 d8 a7
  145.  
  146. Any comments to the address on my contact page.
  147. [http://web.archive.org/web/20141021020123/http://www.drh-consultancy.demon.co.uk/key3.html]
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!