From b10ceab2a9db03a3776fbbaeaf53e768317af6a4 Mon Sep 17 00:00:00 2001 From: Ben Pfaff Date: Fri, 9 May 2025 14:04:01 -0700 Subject: [PATCH] work on manual --- rust/doc/src/SUMMARY.md | 4 +- ...wrapper-format.md => encrypted-wrapper.md} | 98 ++++++++++++++++++- rust/doc/src/encrypted-wrapper/index.md | 10 -- .../encrypted-wrapper/password-encoding.md | 77 --------------- 4 files changed, 96 insertions(+), 93 deletions(-) rename rust/doc/src/{encrypted-wrapper/common-wrapper-format.md => encrypted-wrapper.md} (50%) delete mode 100644 rust/doc/src/encrypted-wrapper/index.md delete mode 100644 rust/doc/src/encrypted-wrapper/password-encoding.md diff --git a/rust/doc/src/SUMMARY.md b/rust/doc/src/SUMMARY.md index ab2ede3ab6..fc4f7691ee 100644 --- a/rust/doc/src/SUMMARY.md +++ b/rust/doc/src/SUMMARY.md @@ -195,8 +195,6 @@ - [SPSS Viewer File Format](spv/index.md) - [Structure Members](spv/structure.md) - [Light Detail Members](spv/light-detail.md) -- [Encrypted File Wrappers](encrypted-wrapper/index.md) - - [Common Wrapper Format](encrypted-wrapper/common-wrapper-format.md) - - [Password Encoding](encrypted-wrapper/password-encoding.md) +- [Encrypted File Wrappers](encrypted-wrapper.md) - [SPSS Portable File Format](portable.md) - [SPSS/PC+ System File Format](pc+.md) \ No newline at end of file diff --git a/rust/doc/src/encrypted-wrapper/common-wrapper-format.md b/rust/doc/src/encrypted-wrapper.md similarity index 50% rename from rust/doc/src/encrypted-wrapper/common-wrapper-format.md rename to rust/doc/src/encrypted-wrapper.md index d7d6365f7a..1b8994a086 100644 --- a/rust/doc/src/encrypted-wrapper/common-wrapper-format.md +++ b/rust/doc/src/encrypted-wrapper.md @@ -1,4 +1,15 @@ -# Common Wrapper Format +# Encrypted File Wrappers + +SPSS 21 and later can package multiple kinds of files inside an +encrypted wrapper. The wrapper has a common format, regardless of the +kind of the file that it contains. + +> ⚠️ Warning: The SPSS encryption wrapper is poorly designed. When the +password is unknown, it is much cheaper and faster to decrypt a file +encrypted this way than if a well designed alternative were used. If +you must use this format, use a 10-byte randomly generated password. + +## Common Wrapper Format An encrypted file wrapper begins with the following 36-byte header, where `xxx` identifies the type of file encapsulated: `SAV` for a system @@ -46,7 +57,7 @@ The AES-256 key is derived from a password in the following way: 4. The 32-byte AES-256 key is `cmac || cmac`, that is, `cmac` repeated twice. -## Example +### Example Consider the password `pspp`. `password` is: @@ -68,7 +79,7 @@ The AES-256 key is: 0010 3e da 09 8e 66 04 d4 fd f9 63 0c 2c a8 6f b0 45 ``` -## Checking Passwords +### Checking Passwords A program reading an encrypted file may wish to verify that the password it was given is the correct one. One way is to verify that @@ -91,3 +102,84 @@ wrapped, to obtain a "magic number" for the beginning of the file. * The plaintext of viewer files begins with `50 4b 03 04 14 00 08` (`50 4b` is `PK`). +## Password Encoding + +SPSS also supports what it calls "encrypted passwords." + +> ⚠️ Warning: SPSS "encrypted passwords" are not encrypted. They are +encoded with a simple, fixed scheme and can be decoded to the original +password using the rules described below. + +An encoded password is always a multiple of 2 characters long, and +never longer than 20 characters. The characters in an encoded +password are always in the graphic ASCII range 33 through 126. Each +successive pair of characters in the password encodes a single byte in +the plaintext password. + +Use the following algorithm to decode a pair of characters: + +1. Let `a` be the ASCII code of the first character, and `b` be the + ASCII code of the second character. + +2. Let `ah` be the most significant 4 bits of `a`. Find the line in + the table below that has `ah` on the left side. The right side of + the line is a set of possible values for the most significant 4 + bits of the decoded byte. + + ``` + 2 ⇒ 2367 + 3 ⇒ 0145 + 47 ⇒ 89cd + 56 ⇒ abef + ``` + +3. Let `bh` be the most significant 4 bits of `b`. Find the line in + the second table below that has `bh` on the left side. The right + side of the line is a set of possible values for the most + significant 4 bits of the decoded byte. Together with the results + of the previous step, only a single possibility is left. + + ``` + 2 ⇒ 139b + 3 ⇒ 028a + 47 ⇒ 46ce + 56 ⇒ 57df + ``` + +4. Let `al` be the least significant 4 bits of `a`. Find the line in + the table below that has `al` on the left side. The right side of + the line is a set of possible values for the least significant 4 + bits of the decoded byte. + + ``` + 03cf ⇒ 0145 + 12de ⇒ 2367 + 478b ⇒ 89cd + 569a ⇒ abef + ``` + +5. Let `bl` be the least significant 4 bits of `b`. Find the line in + the table below that has `bl` on the left side. The right side of + the line is a set of possible values for the least significant 4 + bits of the decoded byte. Together with the results of the + previous step, only a single possibility is left. + + ``` + 03cf ⇒ 028a + 12de ⇒ 139b + 478b ⇒ 46ce + 569a ⇒ 57df + ``` + +### Example + +Consider the encoded character pair `-|`. `a` is 0x2d and `b` is +0x7c, so `ah` is 2, `bh` is 7, `al` is 0xd, and `bl` is 0xc. `ah` +means that the most significant four bits of the decoded character is +2, 3, 6, or 7, and `bh` means that they are 4, 6, 0xc, or 0xe. The +single possibility in common is 6, so the most significant four bits +are 6. Similarly, `al` means that the least significant four bits are +2, 3, 6, or 7, and `bl` means they are 0, 2, 8, or 0xa, so the least +significant four bits are 2. The decoded character is therefore 0x62, +the letter `b`. + diff --git a/rust/doc/src/encrypted-wrapper/index.md b/rust/doc/src/encrypted-wrapper/index.md deleted file mode 100644 index 7a0c5b8f6b..0000000000 --- a/rust/doc/src/encrypted-wrapper/index.md +++ /dev/null @@ -1,10 +0,0 @@ -# Encrypted File Wrappers - -SPSS 21 and later can package multiple kinds of files inside an -encrypted wrapper. The wrapper has a common format, regardless of the -kind of the file that it contains. - -> ⚠️ Warning: The SPSS encryption wrapper is poorly designed. When the -password is unknown, it is much cheaper and faster to decrypt a file -encrypted this way than if a well designed alternative were used. If -you must use this format, use a 10-byte randomly generated password. diff --git a/rust/doc/src/encrypted-wrapper/password-encoding.md b/rust/doc/src/encrypted-wrapper/password-encoding.md deleted file mode 100644 index a123d77c18..0000000000 --- a/rust/doc/src/encrypted-wrapper/password-encoding.md +++ /dev/null @@ -1,77 +0,0 @@ -# Password Encoding - -SPSS also supports what it calls "encrypted passwords." These are not -encrypted. They are encoded with a simple, fixed scheme. An encoded -password is always a multiple of 2 characters long, and never longer -than 20 characters. The characters in an encoded password are always -in the graphic ASCII range 33 through 126. Each successive pair of -characters in the password encodes a single byte in the plaintext -password. - -Use the following algorithm to decode a pair of characters: - -1. Let `a` be the ASCII code of the first character, and `b` be the - ASCII code of the second character. - -2. Let `ah` be the most significant 4 bits of `a`. Find the line in - the table below that has `ah` on the left side. The right side of - the line is a set of possible values for the most significant 4 - bits of the decoded byte. - - ``` - 2 ⇒ 2367 - 3 ⇒ 0145 - 47 ⇒ 89cd - 56 ⇒ abef - ``` - -3. Let `bh` be the most significant 4 bits of `b`. Find the line in - the second table below that has `bh` on the left side. The right - side of the line is a set of possible values for the most - significant 4 bits of the decoded byte. Together with the results - of the previous step, only a single possibility is left. - - ``` - 2 ⇒ 139b - 3 ⇒ 028a - 47 ⇒ 46ce - 56 ⇒ 57df - ``` - -4. Let `al` be the least significant 4 bits of `a`. Find the line in - the table below that has `al` on the left side. The right side of - the line is a set of possible values for the least significant 4 - bits of the decoded byte. - - ``` - 03cf ⇒ 0145 - 12de ⇒ 2367 - 478b ⇒ 89cd - 569a ⇒ abef - ``` - -5. Let `bl` be the least significant 4 bits of `b`. Find the line in - the table below that has `bl` on the left side. The right side of - the line is a set of possible values for the least significant 4 - bits of the decoded byte. Together with the results of the - previous step, only a single possibility is left. - - ``` - 03cf ⇒ 028a - 12de ⇒ 139b - 478b ⇒ 46ce - 569a ⇒ 57df - ``` - -## Example - -Consider the encoded character pair `-|`. `a` is 0x2d and `b` is -0x7c, so `ah` is 2, `bh` is 7, `al` is 0xd, and `bl` is 0xc. `ah` -means that the most significant four bits of the decoded character is -2, 3, 6, or 7, and `bh` means that they are 4, 6, 0xc, or 0xe. The -single possibility in common is 6, so the most significant four bits -are 6. Similarly, `al` means that the least significant four bits are -2, 3, 6, or 7, and `bl` means they are 0, 2, 8, or 0xa, so the least -significant four bits are 2. The decoded character is therefore 0x62, -the letter `b`. - -- 2.30.2