mirror of
https://github.com/keepassxreboot/keepassxc-browser.git
synced 2026-03-11 08:54:43 +00:00
Merge pull request #845 from ususdei/improve_protocol_docs
Clarify key pair usages in protocol description
This commit is contained in:
Sami Vänttinen
GitHub
commit
005613e643
1 changed files with 41 additions and 36 deletions
|
|
@ -10,11 +10,16 @@ Now the requests are encrypted by [TweetNaCl.js](https://github.com/dchest/tweet
|
|||
5. When KeePassXC sends a message it is encrypted with keepassxc-browser's public key and an incremented nonce.
|
||||
6. Databases are stored with newly created public key used with `associate`. A new key pair for data transfer is generated each time keepassxc-browser is launched. This saved key is not used again, as it's only used for identification.
|
||||
|
||||
Thus there are three key pairs involved in every communication:
|
||||
- `host key` - A temporary key pair created by KeePassXC to encrypt the communication of the current session.
|
||||
- `client key` - A temporary key pair created by keepassxc-browser to encrypt the communication of the current session.
|
||||
- `identification key` - A permanent key pair created by keepassxc-browser used to authenticate the browser in later sessions after it was successfully *associated* with a database. This one should be stored safely by the browser. Note that only the public key part is ever used which might be a tiny flaw in the protocol since that part is also stored in the database.
|
||||
|
||||
Encrypted messages are built with these JSON parameters:
|
||||
- action - `test-associate`, `associate`, `get-logins`, `get-logins-count`, `set-login`...
|
||||
- message - Encrypted message, base64 encoded
|
||||
- nonce - 24 bytes long random data, base64 encoded. This is incremented to the response.
|
||||
- clientID - 24 bytes long random data, base64 encoded. This is used to identify different browsers if multiple are used with proxy application.
|
||||
- clientID - 24 bytes long random data, base64 encoded. This is used for a single session to identify different browsers if multiple are used with proxy application.
|
||||
|
||||
Currently these messages are implemented:
|
||||
- `change-public-keys`: Request for passing public keys from client to server and back.
|
||||
|
|
@ -30,17 +35,17 @@ Currently these messages are implemented:
|
|||
|
||||
### change-public-keys
|
||||
Request:
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "change-public-keys",
|
||||
"publicKey": "<current public key>",
|
||||
"publicKey": "<client public key>",
|
||||
"nonce": "tZvLrBzkQ9GxXq9PvKJj4iAnfPT0VZ3Q",
|
||||
"clientID": "<clientID>"
|
||||
}
|
||||
```
|
||||
|
||||
Response (success):
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "change-public-keys",
|
||||
"version": "2.2.0",
|
||||
|
|
@ -51,14 +56,14 @@ Response (success):
|
|||
|
||||
### get-databasehash
|
||||
Unencrypted message:
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "get-databasehash"
|
||||
}
|
||||
```
|
||||
|
||||
Request:
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "get-databasehash",
|
||||
"message": "<encrypted message>",
|
||||
|
|
@ -68,7 +73,7 @@ Request:
|
|||
```
|
||||
|
||||
Response message data (success, decrypted):
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "hash",
|
||||
"hash": "29234e32274a32276e25666a42",
|
||||
|
|
@ -78,16 +83,16 @@ Response message data (success, decrypted):
|
|||
|
||||
### associate
|
||||
Unencrypted message:
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "associate",
|
||||
"key": "<current public key>",
|
||||
"idKey": "<a new identification key>"
|
||||
"key": "<client public key>",
|
||||
"idKey": "<a new identification public key>"
|
||||
}
|
||||
```
|
||||
|
||||
Request:
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "associate",
|
||||
"message": "<encrypted message>",
|
||||
|
|
@ -97,7 +102,7 @@ Request:
|
|||
```
|
||||
|
||||
Response message data (success, decrypted):
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"hash": "29234e32274a32276e25666a42",
|
||||
"version": "2.2.0",
|
||||
|
|
@ -109,16 +114,16 @@ Response message data (success, decrypted):
|
|||
|
||||
### test-associate
|
||||
Unencrypted message:
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "test-associate",
|
||||
"id": "<saved database identifier>",
|
||||
"key": "<saved database public key>"
|
||||
"id": "<saved database identifier received from associate>",
|
||||
"key": "<saved identification public key>"
|
||||
}
|
||||
```
|
||||
|
||||
Request:
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "test-associate",
|
||||
"message": "<encrypted message>",
|
||||
|
|
@ -128,7 +133,7 @@ Request:
|
|||
```
|
||||
|
||||
Response message data (success, decrypted):
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"version": "2.2.0",
|
||||
"nonce": "tZvLrBzkQ9GxXq9PvKJj4iAnfPT0VZ3Q",
|
||||
|
|
@ -140,7 +145,7 @@ Response message data (success, decrypted):
|
|||
|
||||
### generate-password
|
||||
Request (no unencrypted message is needed):
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "generate-password",
|
||||
"nonce": "tZvLrBzkQ9GxXq9PvKJj4iAnfPT0VZ3Q",
|
||||
|
|
@ -149,7 +154,7 @@ Request (no unencrypted message is needed):
|
|||
```
|
||||
|
||||
Response message data (success, decrypted):
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"version": "2.2.0",
|
||||
"entries": [
|
||||
|
|
@ -165,16 +170,16 @@ Response message data (success, decrypted):
|
|||
|
||||
### get-logins
|
||||
Unencrypted message:
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "get-logins",
|
||||
"url": "<snip>",
|
||||
"submitUrl": optional,
|
||||
"httpAuth": optional,
|
||||
"submitUrl": "<optional>",
|
||||
"httpAuth": "<optional>",
|
||||
"keys": [
|
||||
{
|
||||
"id": <connected_id>,
|
||||
"key": <connected_key>
|
||||
"id": "<saved database identifier received from associate>",
|
||||
"key": "<saved identification public key>"
|
||||
},
|
||||
...
|
||||
]
|
||||
|
|
@ -182,7 +187,7 @@ Unencrypted message:
|
|||
```
|
||||
|
||||
Request:
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "get-logins",
|
||||
"message": "<encrypted message>",
|
||||
|
|
@ -192,7 +197,7 @@ Request:
|
|||
```
|
||||
|
||||
Response message data (success, decrypted):
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"count": "2",
|
||||
"entries" : [
|
||||
|
|
@ -216,7 +221,7 @@ Response message data (success, decrypted):
|
|||
|
||||
### set-login
|
||||
Unencrypted message:
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "set-login",
|
||||
"url": "<snip>",
|
||||
|
|
@ -232,7 +237,7 @@ Unencrypted message:
|
|||
```
|
||||
|
||||
Request:
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "set-login",
|
||||
"message": "<encrypted message>",
|
||||
|
|
@ -242,7 +247,7 @@ Request:
|
|||
```
|
||||
|
||||
Response message data (success, decrypted):
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"count": null,
|
||||
"entries" : null,
|
||||
|
|
@ -256,14 +261,14 @@ Response message data (success, decrypted):
|
|||
|
||||
### lock-database
|
||||
Unencrypted message:
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "lock-database"
|
||||
}
|
||||
```
|
||||
|
||||
Request:
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "lock-database",
|
||||
"message": "<encrypted message>",
|
||||
|
|
@ -273,7 +278,7 @@ Request:
|
|||
```
|
||||
|
||||
Response message data (success always returns an error, decrypted):
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "lock-database",
|
||||
"errorCode": 1,
|
||||
|
|
@ -284,14 +289,14 @@ Response message data (success always returns an error, decrypted):
|
|||
|
||||
### get-database-groups
|
||||
Unencrypted message:
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "get-database-groups"
|
||||
}
|
||||
```
|
||||
|
||||
Request:
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "get-database-groups",
|
||||
"message": "<encrypted message>",
|
||||
|
|
@ -355,7 +360,7 @@ Response message data (success, decrypted):
|
|||
```
|
||||
### create-new-group
|
||||
Unencrypted message:
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "create-new-group",
|
||||
"groupName": "<group name or path>"
|
||||
|
|
@ -363,7 +368,7 @@ Unencrypted message:
|
|||
```
|
||||
|
||||
Request:
|
||||
```javascript
|
||||
```json
|
||||
{
|
||||
"action": "create-new-group",
|
||||
"message": "<encrypted message>",
|
||||
|
|
|
|||
Loading…
Reference in a new issue