6 ms·

Still no KDBX 4 support though? Please consider making it a priority - it looks like someone tried to pull request it but that failed? The older format uses a

Still no KDBX 4 support though? Please consider making it a priority - it looks like someone tried to pull request it but that failed? The older format uses a custom AES-based KDF - and while I don't personally see any major issues with it, I'm much more comfortable with the modern, heavily reviewed Argon2 design used in the KDBX4. https://github.com/keepassxreboot/keepassxc/issues/148 https://github.com/keepassxreboot/keepassxc/issues/148

angelsl 9y ago
That would be me. I wrote the patch against the original KeePassX which seems to be no longer maintained (?). One of the KeePassXC guys asked me to rebase it over so I did. Then we (they) spent a week or two debating on how to support libargon2 and the newer libgcrypt required for ChaCha20, coming to no resolution, and I just lost any motivation to push for them to merge my patch. They also disagreed with the way I implemented KDBX 4 (by adding conditionals to the KDBX reader/writer instead of just creating a whole new class — I did this because KeePass did it this way). I agree that it should be separated, but at that point I already gave up on getting them to accept my patch. The PR is [here](https://github.com/keepassxreboot/keepassxc/pull/399 https://github.com/keepassxreboot/keepassxc/pull/399), you can read it, I know I sound rather impatient here. The other PR on updating their Docker to get newer libraries (libargon2 and libgcrypt) is [here](https://github.com/keepassxreboot/keepassxc/pull/419 https://github.com/keepassxreboot/keepassxc/pull/419). I honestly thought someone else would take it up after I gave up to get it in by 2.2 (it's not even a very big patch), but.. I guess not. Someone with more experience/patience/persistence, please, you can take the patch and rebase it and clean it up to what they want. You'll also need to wait for them to figure out how they want to use the libraries required with their packaging system.
- kronos29296 9y ago
  Hope somebody cleans it up and adds the PR to Keepassxc. I would but I am not a C++ guy.(only Python guy sadly)
- phoerious 9y ago
  KDBX4 is a priority indeed, but we only have limited resources. We hoped to get it into 2.2.0, but it just wasn't possible. We really appreciate your patch and will make sure it lands in 2.3.0. It's not forgotten.
  - angelsl 9y ago
    > we only have limited resources I understand, but I'm still disappointed. You all only needed to come to a decision on how you wanted to proceed with supporting the newer libraries required and I would have taken it from there. I'm not sure if you guys have even now come to a decision on that. And it took a month before someone mentioned they would prefer if the KDBX 4 functionality was separated (and I do agree that it should be). You could probably merge a similarly-sized patch into the kernel in less time...
    - phoerious 9y ago
      I thought we settled on the PPA approach.
- rodorgas 9y ago
  Congrats for your work there. It's sad that they asked you to refactor before raising the separated class issue.

angelsl 9y ago

That would be me. I wrote the patch against the original KeePassX which seems to be no longer maintained (?). One of the KeePassXC guys asked me to rebase it over so I did. Then we (they) spent a week or two debating on how to support libargon2 and the newer libgcrypt required for ChaCha20, coming to no resolution, and I just lost any motivation to push for them to merge my patch. They also disagreed with the way I implemented KDBX 4 (by adding conditionals to the KDBX reader/writer instead of just creating a whole new class — I did this because KeePass did it this way). I agree that it should be separated, but at that point I already gave up on getting them to accept my patch. The PR is [here](https://github.com/keepassxreboot/keepassxc/pull/399 https://github.com/keepassxreboot/keepassxc/pull/399), you can read it, I know I sound rather impatient here. The other PR on updating their Docker to get newer libraries (libargon2 and libgcrypt) is [here](https://github.com/keepassxreboot/keepassxc/pull/419 https://github.com/keepassxreboot/keepassxc/pull/419). I honestly thought someone else would take it up after I gave up to get it in by 2.2 (it's not even a very big patch), but.. I guess not. Someone with more experience/patience/persistence, please, you can take the patch and rebase it and clean it up to what they want. You'll also need to wait for them to figure out how they want to use the libraries required with their packaging system.

kronos29296 9y ago
Hope somebody cleans it up and adds the PR to Keepassxc. I would but I am not a C++ guy.(only Python guy sadly)
phoerious 9y ago
KDBX4 is a priority indeed, but we only have limited resources. We hoped to get it into 2.2.0, but it just wasn't possible. We really appreciate your patch and will make sure it lands in 2.3.0. It's not forgotten.
- angelsl 9y ago
  > we only have limited resources I understand, but I'm still disappointed. You all only needed to come to a decision on how you wanted to proceed with supporting the newer libraries required and I would have taken it from there. I'm not sure if you guys have even now come to a decision on that. And it took a month before someone mentioned they would prefer if the KDBX 4 functionality was separated (and I do agree that it should be). You could probably merge a similarly-sized patch into the kernel in less time...
  - phoerious 9y ago
    I thought we settled on the PPA approach.
rodorgas 9y ago
Congrats for your work there. It's sad that they asked you to refactor before raising the separated class issue.