{"action":"created","issue":{"url":"https://api.github.com/repos/open-keychain/open-keychain/issues/972","labels_url":"https://api.github.com/repos/open-keychain/open-keychain/issues/972/labels{/name}","comments_url":"https://api.github.com/repos/open-keychain/open-keychain/issues/972/comments","events_url":"https://api.github.com/repos/open-keychain/open-keychain/issues/972/events","html_url":"https://github.com/open-keychain/open-keychain/issues/972","id":46386938,"number":972,"title":"Lock pattern passphrases","user":{"login":"Valodim","id":27813,"avatar_url":"https://avatars.githubusercontent.com/u/27813?v=3","gravatar_id":"","url":"https://api.github.com/users/Valodim","html_url":"https://github.com/Valodim","followers_url":"https://api.github.com/users/Valodim/followers","following_url":"https://api.github.com/users/Valodim/following{/other_user}","gists_url":"https://api.github.com/users/Valodim/gists{/gist_id}","starred_url":"https://api.github.com/users/Valodim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Valodim/subscriptions","organizations_url":"https://api.github.com/users/Valodim/orgs","repos_url":"https://api.github.com/users/Valodim/repos","events_url":"https://api.github.com/users/Valodim/events{/privacy}","received_events_url":"https://api.github.com/users/Valodim/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/open-keychain/open-keychain/labels/discussion","name":"discussion","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2014-10-21T12:23:42Z","updated_at":"2015-01-01T20:37:04Z","closed_at":null,"body":"Related to #740.\r\n\r\nWe have been throwing around the idea of lock pattern passphrases for a while now. The major problem we'd be facing is exported keys, lock patterns have low entropy (compared to passphrases) so an attacker who can get a hold of the secret key (#194 related) could easily brute-force the passphrase.\r\n\r\nA neat solution to sidestep these problems would be introducing a local custom packet which encrypts the passphrase (or even the private key itself) with the lock pattern. As long as our export logic takes care never to export this packet, that would enable OpenKeychain to access the private key using the lock pattern, but an exported key would still be protected by the regular passphrase just like before.\r\n\r\nThis is not trivial to implement, but most connecting pieces to the puzzle are already there: Passphrase type flags in the database, passphrase changing happens in a single place, the only part missing would be a definite place of \"prepare key for export\", but even that should be relatively simple since ImportExportOperation is already nicely encapsulated.\r\n\r\nThis is not an important feature or anything, and it's not even decided if we want it. Leaving this here for discussion."},"comment":{"url":"https://api.github.com/repos/open-keychain/open-keychain/issues/comments/68497409","html_url":"https://github.com/open-keychain/open-keychain/issues/972#issuecomment-68497409","issue_url":"https://api.github.com/repos/open-keychain/open-keychain/issues/972","id":68497409,"user":{"login":"Valodim","id":27813,"avatar_url":"https://avatars.githubusercontent.com/u/27813?v=3","gravatar_id":"","url":"https://api.github.com/users/Valodim","html_url":"https://github.com/Valodim","followers_url":"https://api.github.com/users/Valodim/followers","following_url":"https://api.github.com/users/Valodim/following{/other_user}","gists_url":"https://api.github.com/users/Valodim/gists{/gist_id}","starred_url":"https://api.github.com/users/Valodim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Valodim/subscriptions","organizations_url":"https://api.github.com/users/Valodim/orgs","repos_url":"https://api.github.com/users/Valodim/repos","events_url":"https://api.github.com/users/Valodim/events{/privacy}","received_events_url":"https://api.github.com/users/Valodim/received_events","type":"User","site_admin":false},"created_at":"2015-01-01T20:37:04Z","updated_at":"2015-01-01T20:37:04Z","body":"I started working on this by allowing addition of \"notation data\" to keyrings in non-exportable direct key signature packets (in 576e6fd0cca41691a52db8e1325508f00a6e9bc6, primarily) and adding a \"pin\" type of passphrase. dominik started working on the lock pattern gui part.\r\n\r\ntodos from the top of my head:\r\n- [ ] make sure non-exportable packets actually aren't exported\r\n- [ ] [change passphrase](https://github.com/open-keychain/open-keychain/issues/194) on key export\r\n- [ ] rework 'change passphrase' dialog (maybe move from 'edit key' into its own activity?)"}}