Store encrypted passphrase locally

[tuanta]

Add an option for users to choose whether store passphrase in browser localStorage (client side) or LDAP (server side). In both cases, passphrase is always encrypted.

[ghost]

Thank you very much for your work, testing this and reviewing it, will probably be done by tuesday.
Barry

[ghost]

I forgot to mention, but Aes.Ctr.decrypt always returns a value,even if it is junk/binary data.
For example if I had stored my passphrase 'test' undecrypted, invoking Aes.Ctr.decrypt('test') will return a wrong result that is <> 'test'.
So we have to change this PR to encrypt passphrases in a recognizableform. For example test or something similar.
We can then look if the decrypted passphrase contains ratherthan only checking if it is empty...

Barry

[ghost]

The Aes.Ctr.decrypt also goes wrong after a user selects 'forget all other private keys', the aes password is then no longer the same for all possible local copies, the user will then be served with a wrong password.

Also, it is easier to not use xml like tags, so we can just substring the password, and be sure it is the correct one. (something like Aes.Ctr.encrypt(-----openpgppassphrase-----=passphrasehere))

[tuanta]

These changes are fine to your comments?
Openroadvietnam@a88ff60

[ghost]

yes, now you only need to check for -----openpgppassphrase---- when decrypting, and it should be fine.Maybe you can

Also:http://www.w3schools.com/jsref/jsref_substring.aspYou do not need to specify the end of the string.
maybe this works: if (!decryptedPassphrase) { tk_barrydegraaff_zimbra_openpgp.privatePassCache = ''; } elseif (decryptedPassphrase.indexOf('openpgppassphrase') > 1)
{ tk_barrydegraaff_zimbra_openpgp.privatePassCache = substring(decryptedPassphrase, 28); }else {
tk_barrydegraaff_zimbra_openpgp.privatePassCache = '';
}

Barry

[ghost]

allowing current users to upgrade to the new version , without having to tell all users to store there passphrase againis also nice:
on line 1326 this.setUserProperty("zimbra_openpgp_privatepass", encryptedPassphrase, false);
change to: this.setUserProperty("zimbra_openpgp_privatepass", '---cryptedpp---' + encryptedPassphrase, false);

and remove that cryptedpp substring everywhere in the code where privatapass is needed.
Then on line 119 I can add another IF statement:
119:var zimbra_openpgp_privatepass = this.getUserProperty("zimbra_openpgp_privatepass");if ( (strlen(zimbra_openpgp_privatepass) > 0) && ( zimbra_openpgp_privatepass.indexOf('cryptedpp') < 1 ) ){//found a zimbra_openpgp_privatepass on server that was stored in a previous version, encrypt itvar encryptedPassphrase = Aes.Ctr.encrypt('-----openpgppassphrase-----='+zimbra_openpgp_privatepass, tk_barrydegraaff_zimbra_openpgp.settings['aes_password'], 256);
this.setUserProperty("zimbra_openpgp_privatepass", '---cryptedpp---' + encryptedPassphrase, false);
}
I may have made a few typos above, and forgot some braces, but writing it this way, is more easy thentrying to explain.
Thanks a lot, for your help!
Barry

[ghost]

The above comments in readable format:
https://gist.github.com/barrydegraaff/e582adb00f1951db4b0c

[tuanta]

I have updated as your comments. Please review all changes.

[ghost]

The equal mark here is a bit vague, will remove that later
-----openpgppassphrase-----=
should be
-----openpgppassphrase-----

[ghost]

Please provide a comment here, and describe what this IF statement is for

[tuanta]

It is similar to the beginning in other switch cases.

[ghost]

Almost there, I provided some inline comments, that can be viewed best using:
https://github.com/barrydegraaff/pgp-zimlet/pull/95/files?diff=split#diff-06d892e505dbbe5fd32f7c66ad232ac2R129

[ghost]

Funny, this feature allows the use of multiple private keys, for example, one could run
Zimbra in Firefox and Chrome, and store a different key and passphrase to local storage....

and it would still work.

[tuanta]

Thanks Barry for accepting my pull request. Hope people will love this new feature.
It is better if we have a way to count whether people prefer to store passphrase at server or client side.
Happy hacking :)

[ghost]

It is better if

• We have a count of the number of installs, or people that use the Zimlet at all.
• Or have someone update the manual and the video and screenshots of the website and the gallery...
• There where more than 24 hours a day, or clone myself :-p

[tuanta]

Yes. I will try my best to work with you :)

[ghost]

I have hereby verified that for users that have a passphrase stored on the server in 1.7.2, that the passphrase is automatically upgraded to an encoded one, and that all auto-decrypt stuff remains operational.

[ghost]

migrate from 1.7.2 -> 1.7.3 with a

• blank user
• user w private key in localstore, no stored passphrase
• user w private key in localstore, passphrase on server
  All migrated without issues or data loss. Looks good.