kdbx 2.6.0

KeepassX format implementation in pure dart. (kdbx 3.x and 4.x support).

kdbx.dart

KeepassX format implementation in pure dart.

Check out AuthPass Password Manager for an app which uses this library.

Resources

• Code is very much based on https://github.com/keeweb/kdbxweb/
• https://gist.github.com/msmuenchen/9318327

Usage

import 'package:kdbx/kdbx.dart';

Future<void> main() async {
  final credentials = Credentials(ProtectedValue.fromString('Lorem Ipsum'));
  final kdbx = KdbxFormat().create(credentials, 'Example');

  final entry = KdbxEntry.create(kdbx, kdbx.body.rootGroup);
  kdbx.body.rootGroup.addEntry(entry);
  entry.setString(KdbxKeyCommon.USER_NAME, PlainValue('example user'));
  entry.setString(
    KdbxKeyCommon.PASSWORD,
    ProtectedValue.fromString('password'),
  );

  final bytes = await kdbx.save();
  final reopened = await KdbxFormat().read(bytes, credentials);
  print(reopened.body.rootGroup.entries.single.getString(KdbxKeyCommon.PASSWORD)
      ?.getText());
}

save() returns the file as bytes and is asynchronous — await it, or the write may not have happened. See example/kdbx_example.dart.

Behaviour worth knowing

• Entry history is bounded by the HistoryMaxItems and HistoryMaxSize the database itself declares. Revisions are dropped oldest-first when a new one is taken and at the end of a merge, never on a plain save, so a file that is already over its limits keeps the history of every entry nobody touches. A negative limit means unlimited; zero keeps nothing; a limit the file does not declare at all is treated as unlimited.
• Unreferenced attachments are dropped from the binary pool on save, once neither an entry nor any of its revisions points at them.
• A move is not a modification. Moving an entry between groups, including into the recycle bin, updates LocationChanged, leaves LastModificationTime alone and records no history revision.
• KdbxGroup.addEntry and KdbxDao.move can throw KdbxDuplicateUuidException, which means move, deleteEntry and deleteGroup can too. It only happens on a file which already carries two live entries with one uuid — the residue of a merge bug fixed after 2.5.0. KdbxFile.duplicateUuidsOnOpen reports such a file on read, and KdbxDao.mergeDuplicateUuidEntries() repairs it.

Features and bugs

• Supports kdbx v3 with native dart implementation
• Supports kdbx v4 with combination with argon2 ffi
• Merging two copies of the same database, for sync

Argon2 support

root directory contains shared libraries (libargon2*) which are built from https://github.com/authpass/argon2_ffi

• MacOS:
  • argon2_ffi/ios/Classes
  • cmake . && cmake --build .
  • cp libargon2_ffi.dylib kdbx.dart/
  • Might need to run: codesign --remove-signature /usr/local/bin/dart https://github.com/dart-lang/sdk/issues/39231#issuecomment-579743656
• Linux:
  • argon2_ffi/ios/Classes
  • cmake . && cmake --build .
  • cp libargon2_ffi.so kdbx.dart/
• Windows:
  • Install Visual Studio Community Edition with C++ Development environment
  • Start "Developer Command Prompt for VS 2019"
  • argon2_ffi/ios/Classes:

    cmake .
    cmake --build .
    cp Debug\argon2_ffi.dll C:\kdbx.dart\argon2_ffi_plugin.dll