Re: Opening Firefox v59 keystore with NSS

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============3871889929455004385==
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="2ASg4w0VoUtSMAx5vUGdvMHtG0GEAKkML"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--2ASg4w0VoUtSMAx5vUGdvMHtG0GEAKkML
From: Renato Alves <[email protected]>
To: Hubert Kario <[email protected]>
Cc: [email protected]
Message-ID: <[email protected]>
Subject: Re: Opening Firefox v59 keystore with NSS
References: <[email protected]>
 <[email protected]>
In-Reply-To: <[email protected]>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Hi Hubert,

Thanks for the reply.

On 25/01/18 19:10, Hubert Kario wrote:
>> With that said, is there any other way to initialize libnss to be able=
 to
>> decode Firefox's profile credentials or is this feature no longer
>> supported?
>=20
> yes, the DBM database format is deprecated and will be removed in some =
time.
> There are multiple bugs in it that nobody is willing to fix and it is=20
> inherently insecure to use it with multiple applications that modify it=
 at the=20
> same time. SQL database does allow safe parallel accesses and uses main=
tained=20
> code. Thus the switch.

Makes sense. Firefox already uses SQLite for other data-stores anyway...

> I'm afraid the tool will have to be modified to support the SQL format =
now.
> As an upside, it will now be safe to use it with Firefox running, provi=
ded all=20
> the necessary locking is performed.

My tool doesn't modify data. Up to now there have been no reported
issues related with this use-case but I understand this could be a proble=
m.

Just to clarify, when you say that the tool will have to support the SQL
format, do you mean my tool will have to query the DB itself, obtain
the key pair (private/public) and initialize libnss by some API other
than the one it currently uses? So far all it needed was to call
NSS_Init() [1] and everything would be handled by that call.

[1] - https://github.com/unode/firefox_decrypt/blob/7a536d045c00cc4cd0b94=
c0d783c39ba1bfd2923/firefox_decrypt.py#L343

On this topic, are you or anyone in the mailing list aware of any
documentation that could help transitioning to the new API? At this
point I'm still unsure about which method's I'd have to call for proper
initialization with the 'new' interface.

Thanks and cheers,
Renato


--2ASg4w0VoUtSMAx5vUGdvMHtG0GEAKkML
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEErWzyn8km9Qx1yUkopwPBKi+mXQQFAlpqKXgACgkQpwPBKi+m
XQTGfg/+KB9Q3JyATyOl9znWDI/eqlfO2SUOwyZhVTFwliuRTadKSrLaWS8BswSV
1t04aFcyo6LDYlLmDXvFSeCNXR9hv+hGTG+mpcrs4JQOuedLUebYFmgkTeK5CfKF
2bJZUEAZNb/IJr72G3OKp/fgwcUetlRyiVcCIhLCLLGJjmJB0WE0r0PjXHTUWkNA
Cs1vxhfM8oeVS6IsGi/QPC9qkJinGfn6ig6vzZklyxvoh/Uku0Byv/Ys35+6S+3A
DPp+g++JXTSKRSiERWpY1a+sONqQB9jF8JE/F+HxT7cj5iVAurHzSxfaNwRngpwE
tJ8zEf1Vi8AnpFAgLDysuJ8cKJq/e6rQNNwP0id3ojeRq5FcKAUJfZVL2xdjVHT/
N9Rkg/W6YzLgoWogxwtwcMwui+OUorpieuTtAwa9t0gXx3XQWnGXOjSGU5cbPqls
L2equ0bxLhX9RJZXefQoFtaVFx+m8qWOHJugeHhQ0+mVqriyF5mT6yl1AgL6e2Cd
Qqs+mrrxWSVazQDaTTYSCObTt1dVNvXf2AwakZnU/5gZk61ctCiRfHdDlVWF0quY
/KgIvXsxpqm1IQMPGjRZ/MPRm0q95DiJED3vlV1Sf0AfC80wLHJbPqfFuGmgVu/a
QFBmM0lJDEikxvH84BsW6NOA5uIXLmbgtrt2R2VlWFRjfKBu3yk=
=ivLt
-----END PGP SIGNATURE-----

--2ASg4w0VoUtSMAx5vUGdvMHtG0GEAKkML--

--===============3871889929455004385==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security

--===============3871889929455004385==--