API

A little deeper into protocol

Generic HTTP request

(based on packet sniffing and code analyssis) Generic HTTP request is json sent in POST message. Cipher, by means of OpenSSL library is AES-256-CBC, so key is 32 byte long.

Host: localhost:19455
Connection: keep-alive
Content-Length: 54
Content-Type: application/json
Accept: */*
Accept-Encoding: gzip, deflate, br

{"RequestType":"test-associate","TriggerUnlock":false}

Also, minimal JSON request (except that one without key set up) consists of four main parameters:

  • RequestType - test-associate, associate, get-logins, get-logins-count, set-login, …
  • TriggerUnlock - TODO: what is this good for? seems always false
  • Nonce - 128 bit (16 bytes) long random vector, base64 encoded, used as IV for aes encryption
  • Verifier - verifier, base64 encoded AES encrypted data: encrypt(base64_encode($nonce), $key, $nonce);
  • Id - Key id entered into KeePass GUI while associate, not used during associate