RE: [libreoffice-users] RE: Libreoffice 3.5.1 corrupted eas256 password protected ODF ver 1.0/1.1 files

Do the same experiment, but this time specify Load/Save default as ODF 1.0/1.1 (not 1.2 or 1.2 
extended).  

If that provides a successful Save with Password roundtrip to .sxc and back, you have a possible 
work-around.  

Then, to recover the existing file that is a problem for you, please do my Experiment A with the 
renamed file and modified manifest.

 - Dennis

PS: On opening of the .sxc, the "password is incorrect" means that .sxc import does not realize 
that SHA256-1k is being used for the confirmation and/or it does not recognize AES and attempts to 
decrypt with Blowfish.  When the sanity check on the decryption fails, the implementers assumed 
that it is because the password is incorrect and chose the error message accordingly [;<).

PPS: You have found a bug.  Nothing but the default encryption techniques should be used when 
saving .sxc and ODF 1.0/1.1 formats with password.  Probably the safest work-around is to use .ods 
from now on.
There are also user configuration options to force default (Blowfish) encryption even for ODF 1.2 
documents.  I don't have those details.

-----Original Message-----
From: raido [mailto:1rlibre@klots.eu] 
Sent: Saturday, December 29, 2012 12:21
To: users@global.libreoffice.org
Subject: [libreoffice-users] RE: Libreoffice 3.5.1 corrupted eas256 password protected ODF ver 
1.0/1.1 files

Thank you for quick answer. 

About the scenario... I was using Linux i386 and an old .sxc file, but it
does not depend on os. I just tried it and everyone can repeat it:
OS: MS Windows 7 x64, Libreoffice 3.5.1 fresh installation. If
Tools->Options->Load/Save->General Default file format and ODF settings
changed to 1.2 Estended (recommended).
I created a new file: File->New->Spreadsheet and saved it File->Save As...,
changed file type to OpenOffice.org 1.0 Spreadsheet (.sxc)(*.sxc), checked
Save with password and clicked Save. LibreOffice asks for password twice and
asks if I want to use OpenOffice.org 1.0 Spreadsheet Format or ODF Format.
After choosing 1.0 version. I close the spreadsheet and open it again.
LibreOffice asks for password. After entering the password it says The
password is incorrect. The file cannot be opened. Thats it. The start of
manifest is such as I wrote. ODF 1.0, .sxc with AES256 and SHA256-1k. This
is known problem, but I have not found is it possible to decrypt the
content, or is it impossible.

I belive, this is the same bug:
https://bugs.freedesktop.org/show_bug.cgi?id=47482

I am sorry, I did not provide this information before.

I replaced the content.xml into correct .ods file and changed manifest of
the correct file to give correct checksum, iv, salt and other parameters.

Now your suggestions:

A. 1. Did so
2. opened, did not ask password
3. yes, asked for repairing
4. no, failed, gave Read error (thats normal, as file is encrypted and LO
did not ask for password)

I tried almost the same before writing to the list, only I did not change
the extension to .ods and I left !DOCTYPE to manifest file. The result was
the same.

B. My knowledge here is not yet complete. I tried cat meta.xml |openssl enc
-d -aes-256-cbc -iv `echo "[iv-string from manifest]"|base64 -d|xxd -p`
-pass pass:`echo "[my password]"|pbkdf2.pl \`echo "[salt from
manifest]"|base64 -d|xxd -p\` 1024|xxd -r -p`

where pbkdf2.pl is from
http://www.cit.griffith.edu.au/~anthony/software/pbkdf2.pl

I have to study it more. Or maybe someone can help here also?

C. yes, I know the password.

Thanks again,
Raido



--
View this message in context: 
http://nabble.documentfoundation.org/Libreoffice-3-5-1-corrupted-eas256-password-protected-ODF-ver-1-0-1-1-files-tp4026356p4026468.html
Sent from the Users mailing list archive at Nabble.com.

-- 
For unsubscribe instructions e-mail to: users+help@global.libreoffice.org
Problems? http://www.libreoffice.org/get-help/mailing-lists/how-to-unsubscribe/
Posting guidelines + more: http://wiki.documentfoundation.org/Netiquette
List archive: http://listarchives.libreoffice.org/global/users/
All messages sent to this list will be publicly archived and cannot be deleted


-- 
For unsubscribe instructions e-mail to: users+help@global.libreoffice.org
Problems? http://www.libreoffice.org/get-help/mailing-lists/how-to-unsubscribe/
Posting guidelines + more: http://wiki.documentfoundation.org/Netiquette
List archive: http://listarchives.libreoffice.org/global/users/
All messages sent to this list will be publicly archived and cannot be deleted