tkpwdb - password database

Background

One of the main reasons I carry a Palm Pilot is so that I have my (long) lists of passwords with me at all times. As a network administrator, I have dozens of 'em. I love my new iPAQ, but can't leave the Palm at home 'til I have a secure method of storing those passwords. I also need a way to share those passwords with other admins. Since this program is written in tcl/Tk , it will run on many platforms. I use it not only on my iPaq, but on my desktop Debian Linux system, and other admins run it in Windows 2000.

A stand-alone, comand line program, rc4.tcl is included to allow for encrypting and decrypting arbitrary files.

Security and Encryption

tkpwdb uses the RC4 encryption algorithm. I am no cryptography expert, and I make no guarantees, but with reasonable care, passwords saved with this program should be relatively safe. I wouldn't keep national security secrets using this method, but then I wouldn't be carrying them around on an unsecured handheld computer, either. According to the knowledgeable folks on sci.crypt, alt.security, comp.security.misc, etc., RC4 will provide plenty of protection for this program's purpose.

Maintain common sense, physical security, and use a good passphrase; your passwords should be safe from all but the most determined cracker.

In case you were wondering...
My understanding is that the author, Mr. Rivest and RSA, have copyright protected their implementation of this algorithm, but that the algorithm itself, and as such any independantly derived code to implement it, are in the public domain. I am no lawyer, however...

Usage

Any time the program is launched, it first requests a passphrase. It uses this password to encrypt the data files that are created. If the cancel button is pressed in this window, the program exits rather than try to encrypt the file with an empty passphrase. If an incorrect passphrase has been entered, the data file will not be decrypted, and the display will be blank.

By default, the program will keep the data in a file named .tkpwdb in the user's home directory. If the user's home cannot be ascertained, the file is saved in the current directory. If called with the name of an alternate file as an argument, the program will use that data instead.

The add, edit, and remove buttons can be used to manipulate entries. The buttons are inactive unless an entry is highlighted. Note that there is no warning once the remove button is pressed; the item simply disappears. Use with caution.

The save button is used to save all entries to the data file. Note that there is no prompt on exit if data has not been saved. The user is expected to know when data needs saving. The only time data is automatically saved, is when the password button is used to change the passphrase. Since the passphrase is required to load and save the data, the disk file is updated with the new passphrase immediately.

By clicking on each of the category buttons on the top of the main window, the data may be sorted on that column. This provides a convenient method for selecting similar information, and for quickly locating records. The columns may be resized as needed, and the scrollbars provide access to long records that do no fit entirely into the viewing area.

rc4.tcl - command line utility

In addition to the tkpwdb program, a command line utility is included in the package, rc4.tcl. Using this program, data files may be inspected by dumping their contents to a terminal window, or redirected to a file for export to another database. It is used by including the filename on the command line. The file will be overwritten. Once launched, the program will present a password prompt.
rc4.tcl file

Since the RC4 algorithm is symmetrical, will not only decrypt encrypted input, but can also be used to encrypt data on its input. Since the data file is a simple text file, this facility may be used for batch encryption, or for other facilities.

Copyright

Copyright 2002 Dave W. Capella - All rights reserved

This is free software; the program may be freely copied and used as long as it is accompanied by all documentation, and all attributions remain intact. Changes to the original source must be clearly marked.

There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Get It

Enjoy!
...dave

More iPAQ stuff here