Repository navigation
Conversation
KeePass and KeePassXC can use Argon2id instead of Argon2d; the two are told apart by the KDF UUID in the KDBX 4 header and take the same parameters. Loading such a file failed with "Unknown Cipher UUID". Argon2 now has an Argon2d instance (getInstance(), unchanged) and an Argon2id instance (getArgon2idInstance()), and Encryption.KeyDerivationFunction gains ARGON2ID, so Argon2id files can be loaded, saved with their KDF kept, and new files can choose it with KdbxHeader.setKeyDerivationFunction(ARGON2ID). Tests use a KeePassXC-created KDBX 4.1 file (AES-256, Argon2id 64 MiB, 2 iterations, parallelism 4, password "probe1234", dummy content). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
KeePass and KeePassXC can use Argon2id as the KDBX 4 key derivation function instead of Argon2d. The two variants take the same parameters and are told apart only by the KDF UUID in the outer header (
9E298B19-56DB-4773-B23D-FC3EC6F0A1E6for Argon2id,EF636DDF-8C29-444B-91F7-A9A403E30A0Cfor Argon2d). KeePassJava2 only knows the Argon2d UUID, so loading an Argon2id file fails withIllegalArgumentException: Unknown Cipher UUIDfromEncryption.KeyDerivationFunction.getKdf.Change
Argon2is parameterised by UUID, name and Bouncy Castle Argon2 type, with two singletons:getInstance()(Argon2d, unchanged behaviour and name) and the newgetArgon2idInstance()(Argon2id).createKdfParameters()now writes the instance's own UUID.Encryption.KeyDerivationFunctiongainsARGON2ID, sogetKdf()finds Argon2id on load, saving a loaded database keeps it, and a new KDBX 4 file can choose it withkdbxHeader.setKeyDerivationFunction(Encryption.KeyDerivationFunction.ARGON2ID).ARGON2still means Argon2d.Tests
test/src/test/resources/V4-AES-Argon2id-probe1234.kdbx: written by KeePassXC 2.7.12, KDBX 4.1, AES-256, Argon2id 64 MiB / 2 iterations / parallelism 4, passwordprobe1234, three dummy entries (2 KB).kdbxmodule,Argon2idTest: KDF UUIDs and lookup,createKdfParameters()UUIDs, Argon2d and Argon2id give different keys for the same parameters, reading the header of the KeePassXC file, decrypting it, wrong password still fails, writing and reading back a KDBX 4 stream with Argon2id.jacksonmodule,JacksonArgon2idTest: open the KeePassXC file, save it and reload it (KDF still Argon2id, entries unchanged), and save a new database with Argon2id chosen and reload it.database.mvn -B -P inhibitConsoleOutput clean verifywith JDK 11 (Temurin 11.0.32.1): BUILD SUCCESS, 268 tests, 0 failures, 0 errors, 27 skipped (258 / 27 skipped ondevelopbefore this change).This is against
develop(2.x). I'm happy to open the same change againstv3-developif you'd like it there too.🤖 Generated with Claude Code