| ★ wanayoo — archive 1999 http://gnukeyring.sourceforge.net/ | Nouvelle recherche | Portail wanayoo |
Copyright (C) 1999, 2000 by Martin Pool <mbp@humbug.org.au>
$Id: index.html,v 1.9 2000/05/11 14:15:55 mbp Exp $
This program is free software; you can redistribute it and/or
modify it under the terms of the GNU General Public License as
published by the Free Software Foundation; either version 2 of the
License, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
USA.
For more details see the file COPYING
Introduction |
GNU Keyring lets you securely store digital secret keys on your PalmOS (PalmPilot, Visor, WorkPad) handheld computer. This information might include:
GNU Keyring should be considered to be a beta release. Please don't use it as your only copy of any important data yet. |
Installation |
Download the prc file or source tarball from SourceForge. Install the keyring.prc binary on your handheld. GNU Keyring will create a blank database the first time it runs. GNU Keyring ought to run on any device with PalmOS 2.0 or later, but please let me know how you go. I test it on a PalmIII with PalmOS 3.3. The database can be backed up using the normal Hotsync mechanism. There is currently no support for editing the database on a PC. If you use GNU Keyring, please consider joining the mailing lists. To rebuild from source, you will need the GNU/Palm PalmOS toolchain.
Releases are signed by my GPG public key |
Use |
GNU Keyring stores records called "keys", each of which can contain
The name is shown in the list view even when the database is locked, so it should contain enough information to let you identify the record, but nothing confidential. If no name is assigned, a stable unique ID is shown instead. The keyring is secured by a master password. To view or edit records, you must enter the master password. The master password may be changed through the "Set Password" command in the list view. For your convenience, the keyring can stay unlocked for a time after you enter your master password. You can configure this behaviour through the "Preferences" command. The keyring always locks itself again when you switch to another application. This seems necessary for security, to make sure that the encryption key is not kept unencrypted in memory and out of the program's control. When you need to set a password, GNU Keyring can generate a random password of specified length, optionally including letters, numbers or symbols. Use the "Generate Password" command in the key edit form to do this. I think GNU Keyring approaches the best security one can achieve on this platform. Here are some notes on its vulnerability to brute-force cracking. |
Security Information |
This product contains no cryptographic algorithms. It does call through a standard system trap method into code that may already be present in your version of PalmOS. In general, Palm application databases are not protected on the Hotsync PC, even if they contain private records. Confidential data therefore is visible to anyone who can read that file on the PC. However, GNU Keyring encrypts all data except when it is actually being edited. The master password is not stored in the database. Instead, an MD5 hash of the password and a random 32-bit salt is stored and checked against entered values. Records are protected by DES3-EDE-ECB encryption. The first and second 8-byte halves of an MD5 hash of the password as the two keys. 8-byte blocks of the record (plus zero padding) are processed in this fashion. PalmOS does not have memory protection between applications: a hostile application or PC-based conduit could read information from inside the Keyring database. Keeping records encrypted provides some protection, but it is far from impossible. GNU Keyring attempts to overwrite memory containing sensitive data after use, but this only gives partial protection. The PalmOS pseudorandom number generator is used to generate session keys and random passwords; it may be predictable. You should only Hotsync to trusted computers. It would be possible to (for example) put a trojan on the PC that grabbed the handheld's memory image, or that installed a trojan onto the handheld. You can review the source of GNU Keyring, or rebuild it to get a trusted binary. The web page is at http://gnukeyring.sourceforge.net/. |
Support / Feedback |
GNU Keyring is written and maintained by Martin Pool <mbp@humbug.org.au>. GNU Keyring is not shareware, but if you like this program please consider how you can help the GNU project. You should be able to find up-to-date information about this program at Freshmeat or SourceForge Please report bugs using the SourceForge bug tracking system: GNU Keyring Bug Tracking. |
FAQ |
I have begun using keyring, and am trying to verify that my encrypted data is being backed up on the pc during the hotsync process. How can I ensure that this is happening? Have a look in the backup directory of your desktop software. You should see a file called Keys-Gtkr.pdb -- this is the data. The date on that file will tell you when the file was last backed up. If you're using Unix, you can use the `pilot-file' command to see the encrypted records inside it and their individual modification times. Because the keys are encrypted you can't look inside it at the moment, but there may be support for editing on a PC in the future. Backups didn't work reliably with some Windows client software in 0.7.4 and earlier versions. How do I open the .tar.gz file on Windows? WinZip will open these files happily. If you'd rather use free or command-line software, there is an excellent port of GNU tar in the CygWin toolset. There are probably other archive tools. |
Release History |
|
Coming features |
|
Links |
|
Thanks |
|