Make Apple Keychain format more robust

[kholia]

Closes #3408

This only took 14 years (after the initial format release in 2012)...

CC @magnumripper @solardiz

[solardiz]

Thank you very much @kholia. I don't have time to look at this for real now - hopefully soon. Meanwhile, you could want to see why two CI jobs are failing here.

[kholia]

The CI infrastructure is running into problems:

Configure finished.  Now "make -s clean && make -sj2" to compile.
The authenticity of host 'github.com (140.82.112.3)' can't be established.
ED25519 key fingerprint is SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? make[1]: *** Deleting file 'misc.o'
make[1]: *** Deleting file 'memory.o'
make[1]: *** Deleting file 'mask.o'
make[1]: *** Deleting file 'loader.o'
make: *** [Makefile:202: default] Hangup

Too long with no output (exceeded 10m0s): context deadline exceeded

[magnumripper]

Why the name change for keypass2john.py? In general that is messy and can lead to problems in some setups. Did syntax/options change?

[kholia]

Good point. I believe we can keep the same name as the script is mostly backwards compatible.

[kholia]

This is ready for another rounds of reviews - thanks!

I believe that the CI failures were not related to this PR.

[Copilot]

Copilot review overview

🟡 Changes recommended

The extractor has broken default, output, and unlock paths, and the OpenCL backend does not perform v2 verification.

Review effort: Balanced
Findings: 1 · 5

Open (6)

• Import DES3 for decryption and report missing dependency · New
• Support multiple keychain input files · New
• Restore default hash extraction for no-option invocation · New
• Honor console and disk output options without duplicate printing · New
• Remove unsafe debug print for missing SSGP data · New
• Reject v2 hashes in OpenCL backend without symkey verification · New

What changed in this PR

This PR aims to reduce false positives when cracking Apple Keychain passwords by checking an additional encrypted key blob.

Changes:

• Add a v2 hash format and symmetric-key verification while retaining the legacy format.
• Replace the keychain extractor with a broader Python parser and command-line options.

File	Description
src/​keychain_fmt_plug.c	Verifies v2 candidates against the encrypted key blob.
src/​keychain_common.h	Defines the v2 tag and additional ciphertext fields.
src/​keychain_common_plug.c	Parses and validates v2 hashes.
run/​keychain2john.py	Extracts v2 hashes and adds dump and export options.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The rewritten converter has output compatibility, parsing, and error-handling regressions, while the v2 verification path lacks a test vector.

7 open findings

• Use integer rounding for 4-byte attribute alignment · New
• Send diagnostics to stderr instead of stdout · New
• Preserve basename prefix in converted hash output · New
• Handle invalid keychain structures without aborting conversion · New
• Reject v2 hashes in OpenCL backend without symkey verification
• Fix comment typo · New
• Add embedded v2 keychain test vector · New

5 resolved since last review

• Import DES3 for decryption and report missing dependency
• Remove unsafe debug print for missing SSGP data
• Honor console and disk output options without duplicate printing
• Restore default hash extraction for no-option invocation
• Support multiple keychain input files

🧠 Review effort: Balanced

[Copilot]

🟡 Changes recommended

The rewritten converter contains multiple runtime failures and can emit unusable or unidentified hashes.

4 open findings

• Use actual CSSM key-class enum values · New
• Handle per-file parse errors without aborting processing · New
• Reject oversized symmetric-key ciphertext candidates · New
• Format AppleShare address bytes as a string · New

7 resolved since last review

• Send diagnostics to stderr instead of stdout
• Use integer rounding for 4-byte attribute alignment
• Handle invalid keychain structures without aborting conversion
• Preserve basename prefix in converted hash output
• Reject v2 hashes in OpenCL backend without symkey verification
• Add embedded v2 keychain test vector
• Fix comment typo

🧠 Review effort: Balanced