diff -urNp gnome-keyring-0.4.5/aes.c gnome-keyring-0.4.5-hacked/aes.c

--- gnome-keyring-0.4.5/aes.c	2003-11-28 04:45:09.000000000 +1300

+++ gnome-keyring-0.4.5-hacked/aes.c	2005-09-18 21:14:54.066769856 +1200

@@ -31,6 +31,9 @@

 #include "config.h"

+/* Only build this if there is no PKCS11 support available */

+#ifndef HAVE_PKCS11

+

 #include "aes.h"

 #if defined(G_BYTE_ORDER) && defined(G_BIG_ENDIAN) && defined(G_LITTLE_ENDIAN)

@@ -333,3 +336,5 @@ guint32* aesFeedback(aesParam* ap)

 {

 	return ap->fdback;

 }

+

+#endif /* ! HAVE_PKCS11 */

--- gnome-keyring-0.5.1/configure.in	2006-06-12 12:07:39.000000000 +0100

+++ gnome-keyring-0.5.1-hacked/configure.in	2006-07-21 14:26:36.126696000 +0100

@@ -125,6 +125,17 @@

   done

 fi

+# Check for pkcs11 library

+#

+AC_CHECK_HEADERS(security/cryptoki.h)

+have_pkcs=no

+AC_CHECK_LIB(pkcs11, C_Initialize, have_pkcs=yes)

+if test $have_pkcs = yes; then

+       AC_DEFINE(HAVE_PKCS11,1,[Have pkcs11 library])

+       PKCS_LIBS=-lpkcs11

+fi

+AC_SUBST(PKCS_LIBS)

+

 # Check for /dev/random

 #

 AC_CHECK_FILE(/dev/random, AC_DEFINE(HAVE_DEVRANDOM,1,[Have /dev/random]))

diff -urNp gnome-keyring-0.4.5/gnome-keyring-daemon.c gnome-keyring-0.4.5-hacked/gnome-keyring-daemon.c

--- gnome-keyring-0.4.5/gnome-keyring-daemon.c	2005-05-07 05:13:20.000000000 +1200

+++ gnome-keyring-0.4.5-hacked/gnome-keyring-daemon.c	2005-09-18 21:14:54.064770160 +1200

@@ -29,6 +29,7 @@

 #include <stdio.h>

 #include <string.h>

 #include <signal.h>

+#include <string.h>

 #include <sys/types.h>

 #include <sys/socket.h>

 #include <sys/un.h>

@@ -297,8 +298,11 @@ hash_string (const char *str)

 {

         guchar digest[16];

-	gnome_keyring_md5_string (str, digest);

-	return gnome_keyring_md5_digest_to_ascii (digest);

+	(void) memset(digest, 0, sizeof(digest));

+

+	(void) gnome_keyring_md5_digest (str, strlen(str), digest, sizeof(digest));

+

+	return gnome_keyring_md5_digest_to_ascii(digest, sizeof(digest));

 }

 GnomeKeyringAttributeList *

diff -urNp gnome-keyring-0.4.5/gnome-keyring-daemon-file.c gnome-keyring-0.4.5-hacked/gnome-keyring-daemon-file.c

--- gnome-keyring-0.4.5/gnome-keyring-daemon-file.c	2005-06-28 11:03:00.000000000 +1200

+++ gnome-keyring-0.4.5-hacked/gnome-keyring-daemon-file.c	2005-09-18 21:18:58.505609504 +1200

@@ -26,6 +26,7 @@

 #include <errno.h>

 #include <stdlib.h>

 #include <stdio.h>

+#include <string.h>

 #include <sys/types.h>

 #include <sys/socket.h>

 #include <sys/un.h>

@@ -34,20 +35,189 @@

 #include "gnome-keyring-daemon.h"

 #include "gnome-keyring-proto.h"

-#include "md5.h"

-#include "sha256.h"

+

+#ifdef HAVE_PKCS11

+#include <security/cryptoki.h>

+#else

 #include "aes.h"

+#endif /* HAVE_PKCS11 */

+#include "sha256.h"

+#include "md5.h"

 time_t keyring_dir_mtime = 0;

-static void

-generate_key (const char *password,

-	      guchar salt[8],

-	      int iterations,

-	      guchar key[16],

-	      guchar iv[16])

+#ifdef HAVE_PKCS11

+int

+GetCryptoSession(CK_MECHANISM_TYPE mech, CK_SESSION_HANDLE_PTR hSession)

 {

+	CK_RV rv;

+	CK_ULONG slotcount;

+	CK_SLOT_ID_PTR slot_list;

+	CK_SLOT_ID slot_id;

+	CK_MECHANISM_INFO mech_info;

+	CK_ULONG i;

+

+	if (hSession == NULL) {

+		return (CKR_ARGUMENTS_BAD);

+	}

+

+	/* initialize PKCS #11 */

+	rv = C_Initialize(NULL);

+	if ((rv != CKR_OK) && (rv != CKR_CRYPTOKI_ALREADY_INITIALIZED)) {

+		return (rv);

+	}

+

+	/* get slot count */

+	rv = C_GetSlotList(0, NULL, &slotcount);

+	if (rv != CKR_OK) {

+		return (rv);

+	}

+

+	if (slotcount == 0) {

+		return (CKR_FUNCTION_FAILED);

+	}

+

+	/* allocate memory for slot list */

+	slot_list = malloc(slotcount * sizeof (CK_SLOT_ID));

+	if (slot_list == NULL) {

+		return (CKR_HOST_MEMORY);

+	}

+

+	if ((rv = C_GetSlotList(0, slot_list, &slotcount)) != CKR_OK) {

+		free(slot_list);

+		return (rv);

+	}

+

+	/* find slot with matching mechanism */

+	for (i = 0; i < slotcount; i++) {

+		slot_id = slot_list[i];

+		if (C_GetMechanismInfo(slot_id, mech, &mech_info) == CKR_OK) {

+			break;

+		}

+	}

+

+	if (i == slotcount) {

+		free(slot_list);

+		return (CKR_MECHANISM_INVALID);

+	}

+

+	rv = C_OpenSession(slot_id, CKF_SERIAL_SESSION, NULL, NULL, hSession);

+

+	free(slot_list);

+	return (rv);

+}

+

+static int

+create_key_object(CK_SESSION_HANDLE  hSession, CK_KEY_TYPE ktype, guchar *keydata, guint32 keylen,

+                  CK_OBJECT_HANDLE *hKey)

+{

+	CK_RV rv = CKR_OK;

+	CK_OBJECT_CLASS class = CKO_SECRET_KEY;

+	CK_BBOOL true = TRUE, false =  FALSE;

+

+	CK_ATTRIBUTE template[] = {

+		{CKA_CLASS, NULL, sizeof (class) },

+		{CKA_KEY_TYPE, NULL, sizeof (CKA_KEY_TYPE) },

+		{CKA_TOKEN, NULL, sizeof (false) },

+		{CKA_ENCRYPT, NULL, sizeof (true) },

+		{CKA_VALUE, NULL, keylen }

+	};

+

+	template[0].pValue = &class;

+	template[1].pValue = &ktype;

+	template[2].pValue = &false;

+	template[3].pValue = &true;

+	template[4].pValue = keydata;

+

+	rv = C_CreateObject(hSession, template, 5, hKey);

+	if (rv != CKR_OK) {

+		g_warning ("create_key_object: C_CreateObject error 0x%0x", rv);

+	}

+

+	return (rv);

+}

+#endif /* HAVE_PKCS11 */

+

+static int

+generate_key (const char *password, guchar *salt, int iterations, char *key, char *iv)

+{

+#ifdef HAVE_PKCS11

+	/*

+	 * If we have PKCS11, use the PKCS#5 PKBDF2 algorithm to derive a key 

+	 * from the given password and salt.

+	 */

+	CK_SESSION_HANDLE hSession = CK_INVALID_HANDLE;

+	CK_PKCS5_PBKD2_PARAMS params;

+	CK_OBJECT_CLASS class = CKO_SECRET_KEY;

+	CK_ATTRIBUTE tmpl[3];

+	CK_KEY_TYPE keytype = CKK_AES;

+	CK_OBJECT_HANDLE hKey;

+	CK_MECHANISM mech; 

+	CK_RV rv = CKR_OK;

+	CK_BYTE  fullkey[32];

+	CK_ULONG keylen = 32, passlen = strlen(password);

+	int attrs = 0;

+

+	g_assert (iterations >= 1);

+	if (GetCryptoSession(CKM_PKCS5_PBKD2, &hSession) == CKR_OK) {

+		tmpl[attrs].type = CKA_CLASS;

+		tmpl[attrs].pValue = &class;

+		tmpl[attrs].ulValueLen = sizeof (class);

+		attrs++;

+

+		tmpl[attrs].type = CKA_KEY_TYPE;

+		tmpl[attrs].pValue = &keytype;

+		tmpl[attrs].ulValueLen = sizeof (keytype);

+		attrs++;

+

+		tmpl[attrs].type = CKA_VALUE_LEN;

+		tmpl[attrs].pValue = (void *)&keylen;

+		tmpl[attrs].ulValueLen = keylen;

+		attrs++;

+

+		params.saltSource = CKZ_SALT_SPECIFIED;

+		params.pSaltSourceData = (void *)salt;

+		params.ulSaltSourceDataLen = 8;

+		params.iterations = iterations;

+		params.prf = CKP_PKCS5_PBKD2_HMAC_SHA1;

+		params.pPrfData = NULL;

+		params.ulPrfDataLen = 0;

+		params.pPassword = (CK_UTF8CHAR_PTR)password;

+		params.ulPasswordLen = (CK_ULONG *)&passlen;

+

+		mech.mechanism = CKM_PKCS5_PBKD2;

+		mech.pParameter = &params;

+		mech.ulParameterLen = sizeof (params);

+

+		rv = C_GenerateKey(hSession, &mech, tmpl, attrs, &hKey);

+		if (rv != CKR_OK) {

+			g_warning ("generate_key: C_GenerateKey error 0x%0x", rv);

+			goto cleanup;

+		}

+

+		tmpl[0].type = CKA_VALUE;

+		tmpl[0].pValue = fullkey;

+		tmpl[0].ulValueLen = sizeof(fullkey);

+		rv = C_GetAttributeValue(hSession, hKey, tmpl, 1);

+		if (rv != CKR_OK) {

+			g_warning ("generate_key: C_GenerateKey error 0x%0x", rv);

+			goto cleanup;

+		}

+

+		/*

+		 * We copied the key data from the object, now destroy it.

+		 */

+		(void) C_DestroyObject(hSession, hKey);

+		memcpy (key, fullkey, 16);

+		memcpy (iv, fullkey+16, 16);

+	}

+cleanup:

+	if (hSession != CK_INVALID_HANDLE)

+		C_CloseSession(hSession);

+

+#else

 	sha256Param sha;

+	int rv = 0;

 	guchar digest[32];

 	g_assert (iterations >= 1);

@@ -67,6 +237,8 @@ generate_key (const char *password,

 	memcpy (key, digest, 16);

 	memcpy (iv, digest+16, 16);

+

+#endif /* HAVE_PKCS11 */

 }

 static gboolean

@@ -77,17 +249,61 @@ encrypt_buffer (GString *buffer,

 {

         guchar key[16];

         guchar iv[16];

+#ifdef HAVE_PKCS11

+	CK_SESSION_HANDLE hSession = CK_INVALID_HANDLE;

+	CK_MECHANISM mechanism;

+	CK_OBJECT_HANDLE hKey;

+	CK_RV rv;

+	CK_ULONG cipherlen;

+#else

 	aesParam param;

 	guchar dst[16];

 	guchar src[16];

 	size_t pos;

 	int i;

+#endif

 	g_assert (buffer->len % 16 == 0);

-	generate_key (password, salt, iterations,

-		      key, iv);

-	

+        if (generate_key (password, salt, iterations, (char *)key, (char *)iv) != 0)

+                return (FALSE);

+#ifdef HAVE_PKCS11

+        rv = GetCryptoSession(CKM_AES_CBC, &hSession);

+        if (rv != CKR_OK) {

+                g_warning ("encrypt_buffer: GetCryptoSession error 0x%0x", rv);

+                return (FALSE);

+        }

+ 

+        rv = create_key_object(hSession, CKK_AES, key, sizeof(key), &hKey);

+        if (rv != CKR_OK) {

+                (void)C_CloseSession(hSession);

+                return (FALSE);

+        }

+ 

+        /* Setup to do AES CBC mode with the given IV */

+        mechanism.mechanism = CKM_AES_CBC;

+        mechanism.pParameter = iv;

+	mechanism.ulParameterLen = sizeof (iv);

+

+	rv = C_EncryptInit(hSession, &mechanism, hKey);

+	if (rv != CKR_OK) {

+		g_warning ("encrypt_buffer: C_EncryptInit error 0x%0x", rv);

+		goto cleanup;

+	}

+

+	cipherlen = buffer->len;

+	/* encrypt the whole buffer in-place. */

+	if ((rv = C_Encrypt(hSession, (CK_BYTE_PTR)buffer->str, buffer->len, (CK_BYTE_PTR)buffer->str, &cipherlen)) != CKR_OK)

+	g_warning ("encrypt_buffer: C_Encrypt error 0x%0x", rv);

+

+cleanup:

+	(void)C_DestroyObject(hSession, hKey);

+	(void)C_CloseSession(hSession);

+	if (rv != CKR_OK) {

+		return (FALSE);

+	}

+

+#else

 	if (aesSetup(&param, key, 128, ENCRYPT)) {

 		return FALSE;

 	}

@@ -103,6 +319,8 @@ encrypt_buffer (GString *buffer,

 		memcpy (buffer->str + pos, dst, 16);

 	}

+#endif /* HAVE_PKCS11 */

+

 	return TRUE;

 }

@@ -114,23 +332,79 @@ decrypt_buffer (GString *buffer,

 {

         guchar key[16];

         guchar iv[16];

+#ifdef HAVE_PKCS11

+        CK_SESSION_HANDLE hSession = CK_INVALID_HANDLE;

+        CK_MECHANISM mechanism;

+        CK_OBJECT_HANDLE hKey;

+        CK_RV rv;

+        CK_ULONG cipherlen;

+        CK_BYTE dst[16];

+#else

 	aesParam param;

-	guchar dst[16];

+        guchar *dst;

+        guint32 dstint[4];

+        guint32 srcint[4];

 	size_t pos;

 	int i;

+#endif

 	g_assert (buffer->len % 16 == 0);

-	generate_key (password, salt, iterations,

-		      key, iv);

+        if (generate_key (password, salt, iterations, (char *)key, (char *)iv))

+                return FALSE;

+ 

+#ifdef HAVE_PKCS11

+        rv = GetCryptoSession(CKM_AES_CBC, &hSession);

+        if (rv != CKR_OK) {

+                g_warning ("decrypt_buffer: GetCryptoSession error 0x%0x", rv);

+                return (FALSE);

+        }

+ 

+        rv = create_key_object(hSession, CKK_AES, key, sizeof(key), &hKey);

+        if (rv != CKR_OK) {

+                (void)C_CloseSession(hSession);

+                return (FALSE);

+        }

+ 

+        mechanism.mechanism = CKM_AES_CBC;

+        mechanism.pParameter = iv;

+        mechanism.ulParameterLen = sizeof(iv);

+ 

+        rv = C_DecryptInit(hSession, &mechanism, hKey);

+        if (rv != CKR_OK) {

+                g_warning ("decrypt_buffer: C_DecryptInit error 0x%0x", rv);

+                goto cleanup;

+        }

+ 

+        cipherlen = buffer->len;

+        /* decrypt the entire buffer in-place */

+        if ((rv = C_Decrypt(hSession, (CK_BYTE *)buffer->str, buffer->len,

+                                                (CK_BYTE *)buffer->str, &cipherlen))) {

+                g_warning ("decrypt_buffer: C_Decrypt error 0x%0x", rv);

+        }

+ 

+cleanup:

+        (void)C_DestroyObject(hSession, hKey);

+        (void)C_CloseSession(hSession);

+ 

+        if (rv != CKR_OK)

+                return (FALSE);

+ 

+#else

+

 	if (aesSetup(&param, key, 128, DECRYPT)) {

 		return FALSE;

 	}

 	for (pos = 0; pos < buffer->len; pos += 16) {

-		if (aesDecrypt (&param, (guint32*) dst, (guint32*) (buffer->str + pos))) {

+                /* Copy the data to a properly aligned data struct before the AES operation */

+                memcpy((void *)srcint, buffer->str+pos, 16);

+                if (aesDecrypt (&param, (guint32*) dstint, (guint32 *)srcint)) {

+

 			return FALSE;

 		}

+                dst = (guchar *)dstint;

+

 		for (i = 0; i < 16; i++) {

 			dst[i] = iv[i] ^ dst[i];

 		}

@@ -138,21 +412,19 @@ decrypt_buffer (GString *buffer,

 		memcpy (buffer->str + pos, dst, 16);

 	}

+#endif /* HAVE_PKCS11 */

 	return TRUE;

 }

 static gboolean

 verify_decrypted_buffer (GString *buffer)

 {

-        struct GnomeKeyringMD5Context md5_context;

         guchar digest[16];

-	

-	gnome_keyring_md5_init (&md5_context);

-	gnome_keyring_md5_update (&md5_context,

-				  (guchar *)buffer->str + 16, buffer->len - 16);

-	gnome_keyring_md5_final (digest, &md5_context);

-	

-	return memcmp (buffer->str, digest, 16) == 0;

+

+        if (gnome_keyring_md5_digest((guchar *)(buffer->str + 16), buffer->len - 16,

+                                digest, sizeof (digest)))

+                return (FALSE);

+        return (memcmp (buffer->str, digest, 16) == 0);

 }

 static char *

@@ -278,7 +550,6 @@ generate_file (GString *buffer, GnomeKey

 	GnomeKeyringItem *item;

 	GnomeKeyringAttributeList *hashed;

 	GString *to_encrypt;

-        struct GnomeKeyringMD5Context md5_context;

         guchar digest[16];

 	int i;

@@ -342,11 +613,10 @@ generate_file (GString *buffer, GnomeKey

 		g_string_append_c (to_encrypt, 0);

 	}