Keepassxc: Adding support for KDBX4 file format

[TheZ3ro]

KeePass 2.35 introduces version 4 of the KDBX file format. This new format features both improvements and new capabilities. These are outlined in the following sections.

http://keepass.info/help/kb/kdbx_4.html

[droidmonkey]

That's gonna be a doozy to implement... looks like a fun challenge!

[TheZ3ro]

Yep, I think the same :smile:

[debfx]

Dependency wise it requires ChaCha20 and Argon2.

ChaCha20 is implemented in libgcrypt 1.7 but the release is less than a year old so not widely supported in current Linux distros.

For Argon2 embedding https://github.com/P-H-C/phc-winner-argon2 seems to be the best option for now.

[fcore117]

Just include library statically, you do not have to folow Linux rules to stay behind with development.

[TheZ3ro]

KeePassX related PR https://github.com/keepassx/keepassx/pull/200

[Diapolo]

Didn't see this sorry, so please keep us updated on your progress :). I appreciate your work on KDBX 4 support.

[grinapo]

Wouldn't the PR in @TheZ3ro's comment actually resolve this?

[droidmonkey]

It kind of does, but the way it was implemented was not very good. It intertwined the code between kdbx3 and kdbx4 instead of building a new reader/writer class specifically for kdbx4.

[sergeevabc]

O ChaCha20, where art thou?

[phoerious]

We are basically through all the ground work and will add new ciphers from here: https://github.com/keepassxreboot/keepassxc/pull/1230

[MyXelf]

Is there any way to keep building the develop branch of KPXC on current Ubuntu LTS based Linux distros? Due to the lack of Argon2 and the required gcrypt libs, this looks like a dead end, at least until April this year.

I've been using the develop branch since a long time ago. Probably the suggestion would be to use the master branch, but there is a long list of features/bugfixes that are only in the develop branch as the most "stable" one (more than 6 months of code).

Perhaps due to the intrinsic complications of the KDBX4 implementation, I'm missing something and this WIP with no ETA can't be done in a feature branch.

Any suggestions are welcome, thanks

[ArchangeGabriel]

Why don’t you just build argon2 yourself? See #1401.

[phoerious]

Ubuntu ships libargon2-0-dev starting with 16.04. For 14.04 you can install it from our PPA: https://launchpad.net/~phoerious/+archive/ubuntu/keepassxc

We also ship the required versions of libgcrypt20 and libgpg-error for both 14.04 and 16.04 through that PPA.

[MyXelf]

Thanks for the suggestions. I'll try those.

[phoerious]

I updated the wiki page: https://github.com/keepassxreboot/keepassxc/wiki/Set-up-Build-Environment-on-Linux

[sergeevabc]

Is there a Windows build available with implemented KDBX4 features?

[phoerious]

Not yet. We will release a beta version soon.

[ArchangeGabriel]

The FAQ should be updated: https://keepassxc.org/docs/#faq-kdbx4.

[phoerious]

Done. Thanks for the reminder.

[antimech]

Why not make argon2 by default KDF?

[phoerious]

It's going to be the default in 2.4.

[antimech]

@phoerious thanks for your answer!

[antimech]

@phoerious, btw. Where can I find upcoming release dates?

[Generator]

@antimech https://github.com/keepassxreboot/keepassxc/milestone/12

[antimech]

@Generator, thanks!

[phoerious]

The release dates set for milestones are not accurate. They are merely ballpark guesses of when we think we'll be finished.