What is the intended use of TScFileStorage.Password?

Discussion of open issues, suggestions and bugs regarding network security and data protection solution - SecureBridge
Post Reply
jasoev
Posts: 1
Joined: Thu 05 Nov 2009 16:55

What is the intended use of TScFileStorage.Password?

Post by jasoev » Thu 05 Nov 2009 17:26

Hello,

I tried the following experiment to figure out how the password is used.

1) Set FFileStorage.Password := 'test';
2) Established a connection, causing a key file to be generated.
3) Closed the application.
4) Commented out FFileStorage.Password := 'test';
5) Ran the application again. On this reconnect attempt I was not prompted and no exception was raised. The key was recovered and was Ready, even without using the password.

Was I doing something wrong? What is the intended use of this feature?

Thanks.

My handler code:

procedure TForm1.ScSSHClient1ServerKeyValidate(Sender: TObject;
NewServerKey: TScKey; var Accept: Boolean);
var
fingerPrint : string;
key: TScKey;
msg: string;
hostKeyName : string;
begin

if FClient.HostKeyName = '' then
begin
hostKeyName := FClient.HostName;
end else
begin
hostKeyName := FClient.HostKeyName;
end;

key := FFileStorage.Keys.FindKey(hostKeyName);

if (Key = nil) or not Key.Ready then begin
NewServerKey.GetFingerPrint(haMD5, fingerPrint);
msg := 'The authenticity of server can not be verified.'#13#10 +
'Fingerprint for the key received from server: ' + fingerPrint + '.'#13#10 +
'Key length: ' + IntToStr(NewServerKey.BitCount) + ' bits.'#13#10 +
'Are you sure you want to continue connecting?';

if MessageDlg(msg, mtConfirmation, [mbOk, mbCancel], 0) = mrOk then begin
Key := TScKey.Create(nil);
try
Key.Assign(NewServerKey);
Key.KeyName := HostKeyName;

//This line is not commented out initially to generate a password protected file.
// FFileStorage.Password := 'test';

FFileStorage.Keys.Add(Key);
except
Key.Free;
raise;
end;

Accept := True;
end;
end;

end;

Dimon
Devart Team
Posts: 2910
Joined: Mon 05 Mar 2007 16:32

Post by Dimon » Fri 06 Nov 2009 08:15

The point is that only private keys are encrypted. Public keys are not encrypted because they don't keep private information.

Post Reply