Re: Opening Firefox v59 keystore with NSS

--===============5390913363716018047==
Content-Type: multipart/signed; boundary="nextPart5105303.eTok7oul3Q"; micalg="pgp-sha512"; protocol="application/pgp-signature"

--nextPart5105303.eTok7oul3Q
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="UTF-8"

On Thursday, 25 January 2018 20:01:12 CET Renato Alves wrote:
> Hi Hubert,
>=20
> Thanks for the reply.
>=20
> On 25/01/18 19:10, Hubert Kario wrote:
> >> With that said, is there any other way to initialize libnss to be able=
 to
> >> decode Firefox's profile credentials or is this feature no longer
> >> supported?
> >=20
> > yes, the DBM database format is deprecated and will be removed in some
> > time. There are multiple bugs in it that nobody is willing to fix and it
> > is inherently insecure to use it with multiple applications that modify
> > it at the same time. SQL database does allow safe parallel accesses and
> > uses maintained code. Thus the switch.
>=20
> Makes sense. Firefox already uses SQLite for other data-stores anyway...
>=20
> > I'm afraid the tool will have to be modified to support the SQL format
> > now.
> > As an upside, it will now be safe to use it with Firefox running, provi=
ded
> > all the necessary locking is performed.
>=20
> My tool doesn't modify data. Up to now there have been no reported
> issues related with this use-case but I understand this could be a proble=
m.
>=20
> Just to clarify, when you say that the tool will have to support the SQL
> format, do you mean my tool will have to query the DB itself, obtain
> the key pair (private/public) and initialize libnss by some API other
> than the one it currently uses? So far all it needed was to call
> NSS_Init() [1] and everything would be handled by that call.
>=20
> [1] -
> https://github.com/unode/firefox_decrypt/blob/7a536d045c00cc4cd0b94c0d783=
c3
> 9ba1bfd2923/firefox_decrypt.py#L343
>=20
> On this topic, are you or anyone in the mailing list aware of any
> documentation that could help transitioning to the new API? At this
> point I'm still unsure about which method's I'd have to call for proper
> initialization with the 'new' interface.

I thought that you were using it as DBM database, without help of NSS.
If you use nss library, specifying the path to the folder with databse with=
=20
"sql:" as a prefix should be enough.

With certutil it looks like this:

certutil -L -d sql:/home/user/.pki/nssdb

=2D-=20
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purky=C5=88ova 115, 612 00  Brno, Czech Republic
--nextPart5105303.eTok7oul3Q
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part.
Content-Transfer-Encoding: 7Bit

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEYeeuxEU+3unL/K+dkqjRuAHS9fUFAlpqNvkACgkQkqjRuAHS
9fWBGw//clDx6NSQsEC0obqO1fuxLcP6BPNu7sQOwoa/eR7NJ8yT7Tr6EOWaUHFb
XqRYa62Hs0qinDX3TbDxb/QZzZZXypHV1sysr97ASJNU30xtWXhve88kOqQroPzA
XytJayM6DEb7E2VO0wXGOmcul3WaQkjOa95Dd6Qghxs7cQ636beB3W01+1B5qpU9
Gg6Z/WcXNIGTntBqOAB6/J+5PGjaBtVPbaKpiLPUVWuEl8hvIKVnxlRHyY3Nbx1H
GgjRO3lg2lKlIwLR/Arbpp2XmcPCbSOoA2NS9bmVvILTZTfasuI+aK/PHXrGVCw5
PqzOn0kTRFPt00fPUOYlcR3pllPV3MhcJDtC04t/lak2oMJ+ZJlWVUIJsEc39tq4
2txmmyspGcAritGxPi6crEmnC96Q7Pn215uw9Fh6w6ItK9Yp8kMoKwIpvosTDImW
8unuOSj2r3F/cfSUeiOUvS0v2W771kK9i4OhdM1M49yk80ufGD7w7DAKbqI0jTNR
4uWgZzSQqYj6JAK0P3drd1nkx9S44xWm05/cR//wDk0dv8BiWj+WDeBwVdYCw9Il
1ZLqH6MXYTRgpt9BN++Ic1EAvTp9oBQ5kGdmsvQNLK9e/iyEouxx2TnLzDGG6TDv
t89hbrYNFTFj0XkZg5gnZz7w2+3r+/ja01tW/UVHxQoTHFbkLuQ=
=pmMm
-----END PGP SIGNATURE-----

--nextPart5105303.eTok7oul3Q--




--===============5390913363716018047==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security

--===============5390913363716018047==--