#24 kdbx files: Passwords are garbled when doing 'show'

[kyak]

Hi,

The problem i experience is quite easy to reproduce.

1) Have a KeePass 1 database (kdb). This is the database i created and used it with KeePassX 0.4 series.
2) In order to use KeePassX 2, import the database. Save the database.
3) The new kdbx database works fine in KeePassX 2.
4) However, this kdbx doesn't work with kpcli. It opens fine, i can browse it fine, but all passwords are garbled. I see nonsense unicode symbols and question marks (and the copied password doesn't work).

I can see the same problem with KeePass2. This happens even with kdbx files created from scratch. Basically, kdbx files are not usable for me at all.

Did i do something wrong, because i read that people used kdbx files with kpcli?

Also see https://www.keepassx.org/dev/issues/458

[Lester Hightower]

This problem is either with your environment or with the perl module File::KeePass, not with kpcli itself.

[Andy Dicken]

I have this problem as well. It is not present when using a V1 .kdb file (ie v1 files work OK). On Arch Linux using UTF-8.

[Lester Hightower]

Please include the output of kpcli's vers and stats commands.

[Andy Dicken]

*With a kdbx file:

Please provide the master password: *******

KeePass CLI (kpcli) v3.0 is ready for operation.
Type 'help' for a description of available commands.
Type 'help ' for details on individual commands.

kpcli:/> vers
VERSIONS

• kpcli: 3.0
• Perl: v5.22.1
• File::KeePass: 2.03
• Term::ShellUI: 0.92
• Term::ReadKey: 2.33
• Term::ReadLine: 1.15
• Term::ReadLine::Gnu: 1.31
• Capture::Tiny: not installed (optional)
• Clipboard: not installed (optional)
• Data::Password: not installed (optional)
• Sub::Install: not installed (optional)

ReadLine being used: Term::ReadLine::Gnu
Operating system: linux
kpcli:/> stats
File: ***.kdbx
Key file: N/A
Name: Home2
Description:
|
KeePass file version: 2
Encryption type: rijndael
Encryption rounds: 6000
Cipher:
Compression:
Number of groups: 3
Number of entries: 179
Entries with passwords of length:

• 0: 3
• 1-7: 8
• 8-11: 74
• 12-16: 30
• 17-19: 18
• 20+: 46

---

---

---

*With a kdb file:

Please provide the master password: *******

KeePass CLI (kpcli) v3.0 is ready for operation.
Type 'help' for a description of available commands.
Type 'help ' for details on individual commands.

kpcli:/> vers
VERSIONS

• kpcli: 3.0
• Perl: v5.22.1
• File::KeePass: 2.03
• Term::ShellUI: 0.92
• Term::ReadKey: 2.33
• Term::ReadLine: 1.15
• Term::ReadLine::Gnu: 1.31
• Capture::Tiny: not installed (optional)
• Clipboard: not installed (optional)
• Data::Password: not installed (optional)
• Sub::Install: not installed (optional)

ReadLine being used: Term::ReadLine::Gnu
Operating system: linux
kpcli:/> stats
File: ***.kdb
Key file: N/A
KeePass file version: 1
Encryption type: rijndael
Encryption rounds: 150000
Number of groups: 3
Number of entries: 179
Entries with passwords of length:

• 0: 3
• 1-7: 9
• 8-11: 75
• 12-16: 31
• 17-19: 17
• 20+: 44

[Lester Hightower]

Thanks. If you open the kdb in kpcli and saveas foo.kdbx, does that kdbx then work fine? If so, does it also work fine in KeePassX2, etc? In other words, does the original creator of the kdbx file matter to the appearance of this problem?

[Andy Dicken]

If I save as .kdbx, that then works fine in kpcli. If I open that new kdbx in keepassx2, it's garbled again...

[Lester Hightower]

I took some time and ran this experiment myself:

1) Used KeePassX-2.0.2 to import my large kdb file and saved it as a kdbx.
2) Opened it using the latest KeePass2 and verified that it works just fine.
3) Opened it with kpcli and verified that it works just fine (passwords are correct).
4) Saved the file in kpcli.
5) Opened the file in the latest Keepass2 and verified that it works just fine.
6) Opened the file in KeePassX-2.0.2 and verified that it works just fine.

...and so, I cannot replicate your problem.

Here is my environment:

kpcli:/> vers
VERSIONS

 * kpcli: DEVELOPMENT
 * Perl: v5.18.2
 * File::KeePass: 2.03
 * Term::ShellUI: 0.92
 * Term::ReadKey: 2.31
 * Term::ReadLine: 1.12
 * Capture::Tiny: 0.24
 * Clipboard: 0.13
 * Sub::Install: 0.927
 * Term::ReadLine::Gnu: 1.20

ReadLine being used: Term::ReadLine::Gnu
Operating system: linux ("Linux Mint 17 Qiana")
kpcli:/> stats
File: ./keepass.kdbx
Key file: N/A
Name: keepassx
Description:
|
KeePass file version: 2
Encryption type:      rijndael
Encryption rounds:    50000
Cipher:
Compression:
Number of groups:     98
Number of entries:    806
Entries with passwords of length:

  -     0:  51
  -   1-7:  48
  -  8-11: 302
  - 12-16: 231
  - 17-19:  44
  -   20+: 130

kpcli:/> exit

$ perl -v

This is perl 5, version 18, subversion 2 (v5.18.2) built for x86_64-linux-gnu-thread-multi
(with 41 registered patches, see perl -V for more detail)

Copyright 1987-2013, Larry Wall

Perl may be copied only under the terms of either the Artistic License or the
GNU General Public License, which may be found in the Perl 5 source kit.

Complete documentation for Perl, including FAQ lists, should be found on
this system using "man perl" or "perldoc perl".  If you have access to the
Internet, point your browser at http://www.perl.org/, the Perl Home Page.

$ locale
LANG=en_US.UTF-8
LANGUAGE=
LC_CTYPE="en_US.UTF-8"
LC_NUMERIC="en_US.UTF-8"
LC_TIME="en_US.UTF-8"
LC_COLLATE="en_US.UTF-8"
LC_MONETARY="en_US.UTF-8"
LC_MESSAGES="en_US.UTF-8"
LC_PAPER="en_US.UTF-8"
LC_NAME="en_US.UTF-8"
LC_ADDRESS="en_US.UTF-8"
LC_TELEPHONE="en_US.UTF-8"
LC_MEASUREMENT="en_US.UTF-8"
LC_IDENTIFICATION="en_US.UTF-8"
LC_ALL=

[Lester Hightower]

I tested it with kpcli-3.0, also, even though what I copy/pasted above was DEVELOPMENT.

[Lester Hightower]

If it is just the password field that you guys are having trouble with, note that File::KeePass does encrypt just that one field while it is held in RAM and kpcli has to "unlock" the data held in RAM in order to display the password field. Perhaps there is a problem with Crypt::Rijndael on Arch Linux, as that is what is used by File::KeePass to encrypt/decrypt the passwords in RAM. You can see the lock and unlock functions in the File::KeePass sourcecode. To test my theory, you could comment out all of the contents of those two functions (have them do nothing other than "return 1;") and see if your problem goes away.

[Andy Dicken]

In trying to export my kdbx file to kdb using kpcli (so that I can just use the old version files which work fine), I got this error - maybe it helps? I realise that if the passwords couldn't be decrypted then the export would have been useless anyway ;)

Wide character in subroutine entry at /usr/share/perl5/vendor_perl/File/KeePass.pm line 747

[Lester Hightower]

Would it be possible for you to attach a sample file that exhibits this problem with some instructions on how to reproduce it?

[Lester Hightower]

BTW, I suspect that you have one or more passwords that hold one or more characters that cannot be represented by an 8-bit character encoding. I do not believe that is supported by File::KeePass.