Passwords in SSL with Jetty tutorial - ssl

Question

In this tutorial , where are the following values coming from?
password (OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4)
keyPassword (OBF:1u2u1wml1z7s1z7a1wnl1u2g)
trustPassword (OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4)

Answer 1

Someone (ack_ of the Norn Iron Hacker Scene) made a Python script to reverse the Jetty password obfuscation. Useful when you need to export the keystore to other programs.
# Jetty Deobfuscation Tool
from __future__ import print_function
import sys
def deobfuscate_jetty(ciphertext):
plaintext = ""
for i in range(0, len(ciphertext), 4):
t = ciphertext[i:i + 4]
i0 = int(t, 36)
i1, i2 = divmod(i0, 256)
x = (i1 + i2 - 254) >> 1
plaintext += chr(x)
return plaintext
if __name__ == '__main__':
if len(sys.argv) == 2:
print(deobfuscate_jetty(sys.argv[1]))
else:
print("Jetty Deobfuscation Tool v1.0")
print("%s <string>" % sys.argv[0])
exit(1)

Answer 2

The passwords prefixed with OBF: come from Jetty's own system for obfuscating passwords. There is more documentation here: http://wiki.eclipse.org/Jetty/Howto/Secure_Passwords
Note that this is obfuscated and not encrypted. It just prevents a human from reading it quickly:
In some cases such as keystore passwords and digest authentication,
the system must retrieve the original password, which requires the
obfuscation method. The drawback of the obfuscation algorithm is that
it protects passwords from casual viewing only.
You could put them in clear too, it wouldn't change much.
In this case, the password, keyPassword and trustPassword are respectively the passwords for the key store, the key password (that should be optional if it's the same as the key store password) and the trust store password. These are the ones you set when you create these keystores.

Answer 3

This was driving me kind of crazy too. Here's a script that you can use to generate the various passwords. The script works with this particular version of jetty: jetty-hightide-8.1.10.v20130312, but can be modified through the JETTY_VER variable.
jetty-passwd.sh
#!/bin/bash
# url: http://wiki.eclipse.org/Jetty/Howto/Secure_Passwords
# set -x
if [ $# -ne 2 ]; then
echo -e "\nUSAGE: `basename $0`: <user> <password>\n";
exit 0;
fi
JETTY_VER=8.1.10.v20130312
JETTY_HOME=/opt/jetty-hightide-$JETTY_VER
java -cp $JETTY_HOME/lib/jetty-util-${JETTY_VER}.jar org.eclipse.jetty.util.security.Password $1 $2
example run
% ./jetty-passwd.sh me blah
blah
OBF:1t2x1toq1to41t39
MD5:6f1ed002ab5595859014ebf0951522d9
CRYPT:me/DjMjPzbKG.

Answer 4

The following function is an ES6 port of the Python function by Thilo. It could be used to deobfuscate a password on a Node server.
I also added an obfuscation method that I adapted from: arthepsy/deobf/jetty.obf.py
In addition, I added some mocha/chai tests to run through random passwords verify that the obfuscate/deobfuscate methods are symetric.
const
clipText = (str, length) => `${str.slice(0, length)}…`,
fill = (size, fn) => new Array(size).fill(0).map((_, i) => fn ? fn(i) : i);
/** test.js */
const main = () => {
const
generator = new PasswordGenerator({ symbols: true, length: 16 }),
passwords = fill(100, () => generator.next());
mocha.setup('bdd');
chai.should();
describe('Test JettyUtil', () =>
passwords.forEach(pw => {
const
ciphertext = JettyUtil.obfuscate(pw),
plaintext = JettyUtil.deobfuscate(ciphertext);
it(clipText(`${pw} → ${ciphertext}`, 64), () =>
pw.should.equal(plaintext))
}));
mocha.run();
};
/** jetty-util.js */
const
OBF_PREFIX = 'OBF:',
divmod = (m, n) => [ Math.trunc(m / n), m % n ],
unpack = (str) => str.split('').map(c => c.charCodeAt(0) & 0xFF),
chunk = (str, size) => str.match(new RegExp(`.{1,${size}}`, 'g'));
class JettyUtil {
static deobfuscate(ciphertext) {
return chunk(ciphertext.slice(OBF_PREFIX.length), 4)
.reduce((plaintext, i0) => {
const [ i1, i2 ] = divmod(parseInt(i0, 36), 256);
return plaintext + String.fromCharCode((i1 + i2 - 254) >> 1);
}, '');
}
static obfuscate(plaintext) {
return unpack(plaintext).reduce((ciphertext, b1, index, bytes) => {
const b2 = bytes[bytes.length - (index + 1)],
[ i1, i2 ] = [ 127 + b1 + b2, 127 + b1 - b2 ];
return ciphertext + (i1 * 256 + i2).toString(36).padStart(4, '0');
}, OBF_PREFIX);
}
}
// export default JettyUtil;
/** password-generator.js */
const Alphabet = {
UPPERCASE : 'ABCDEFGHIJKLMNOPQRSTUVWXYZ',
LOWERCASE : 'abcdefghijklmnopqrstuvwxyz',
NUMBERS : '0123456789',
SYMBOLS : ' !"#$%&\'()*+,-./:;<=>?#[\]^_`{|}~'
};
class PasswordGenerator {
constructor(config) {
this.opts = { ...PasswordGenerator.defaultOptions, ...config };
this.alphabet = Object.entries(this.opts)
.map(([k, v]) => v === true ? Alphabet[k.toUpperCase()] : null)
.filter(v => v != null)
.join('');
}
next() {
return fill(this.opts.length, () => rando(this.alphabet)).join('');
}
}
PasswordGenerator.defaultOptions = {
uppercase : true,
lowercase : true,
numbers : true,
symbols : false,
length : 12
};
// export default PasswordGenerator;
main();
.as-console-wrapper { top: 0; max-height: 100% !important; }
<script src="https://randojs.com/2.0.0.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/mocha/7.2.0/mocha.min.js"></script>
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/mocha/7.2.0/mocha.css" />
<script src="https://cdnjs.cloudflare.com/ajax/libs/chai/4.2.0/chai.min.js"></script>
<div id="mocha"></div>
Here is my original response:
const divmod = (m, n) => [ ~~(m / n), m % n ];
const deobfuscate = (ciphertext) => {
if (!ciphertext.startsWith('OBF:')) return null;
let plaintext = '';
for (let offset = 4; offset < ciphertext.length; offset += 4) {
const i0 = parseInt(ciphertext.slice(offset, offset + 4), 36);
const [ i1, i2 ] = divmod(i0, 256);
plaintext += String.fromCharCode((i1 + i2 - 254) >> 1);
}
return plaintext;
};
const pwList = [
'OBF:1vny1zlo1x8e1vnw1vn61x8g1zlu1vn4', // storepwd
'OBF:1u2u1wml1z7s1z7a1wnl1u2g', // keypwd
];
pwList.forEach(pw => console.log(deobfuscate(pw)));