Signal database password on Android

[deeppurple]

I looked at code and the problem might be Android crypto objects, but maybe someone understand:

Code:

 public static MasterSecret getMasterSecret(Context context, String passphrase)      throws InvalidPassphraseException  {    try {      byte[] encryptedAndMacdMasterSecret = retrieve(context, "master_secret");      byte[] macSalt                      = retrieve(context, "mac_salt");      int    iterations                   = retrieve(context, "passphrase_iterations", 100);      byte[] encryptedMasterSecret        = verifyMac(macSalt, iterations, encryptedAndMacdMasterSecret, passphrase);      byte[] encryptionSalt               = retrieve(context, "encryption_salt");      byte[] combinedSecrets              = decryptWithPassphrase(encryptionSalt, iterations, encryptedMasterSecret, passphrase);      byte[] encryptionSecret             = Util.split(combinedSecrets, 16, 20)[0];      byte[] macSecret                    = Util.split(combinedSecrets, 16, 20)[1];      return new MasterSecret(new SecretKeySpec(encryptionSecret, "AES"),                              new SecretKeySpec(macSecret, "HmacSHA1"));    } catch (GeneralSecurityException e) {      Log.w("keyutil", e);      return null; //XXX    } catch (IOException e) {      Log.w("keyutil", e);      return null; //XXX    } }

I have all the above data and I see SHA1 so I think great, will be easy and can just compare the MAC:

Code:

 private static byte[] verifyMac(byte[] macSalt, int iterations, byte[] encryptedAndMacdData, String passphrase) throws InvalidPassphraseException, GeneralSecurityException, IOException {    Mac hmac        = getMacForPassphrase(passphrase, macSalt, iterations);    byte[] encryptedData = new byte[encryptedAndMacdData.length - hmac.getMacLength()];    System.arraycopy(encryptedAndMacdData, 0, encryptedData, 0, encryptedData.length);    byte[] givenMac      = new byte[hmac.getMacLength()];    System.arraycopy(encryptedAndMacdData, encryptedAndMacdData.length-hmac.getMacLength(), givenMac, 0, givenMac.length);    byte[] localMac      = hmac.doFinal(encryptedData);    if (Arrays.equals(givenMac, localMac)) return encryptedData;    else                                   throw new InvalidPassphraseException("MAC Error"); }

Code:

 private static Mac getMacForPassphrase(String passphrase, byte[] salt, int iterations)      throws GeneralSecurityException  {    SecretKey     key     = getKeyFromPassphrase(passphrase, salt, iterations);    byte[]        pbkdf2  = key.getEncoded();    SecretKeySpec hmacKey = new SecretKeySpec(pbkdf2, "HmacSHA1");    Mac           hmac    = Mac.getInstance("HmacSHA1");    hmac.init(hmacKey);    return hmac; }

But then I do further and getKeyFromPassphrase() does something different:

Code:

 private static SecretKey getKeyFromPassphrase(String passphrase, byte[] salt, int iterations)      throws GeneralSecurityException  {    PBEKeySpec keyspec    = new PBEKeySpec(passphrase.toCharArray(), salt, iterations);    SecretKeyFactory skf  = SecretKeyFactory.getInstance("PBEWITHSHA1AND128BITAES-CBC-BC");    return skf.generateSecret(keyspec); }

There is AES step?  I try to run code backward in jshell but get NoSuchAlgorithmException on second line. 

What hashcat mode correspond to this operation?  It look like it should be PBKDF2-HMAC-SHA1 but hashcat exhausted a list with known password.  Can two hashcat mode be run consecutive?

I test the bytes 17-37 in the Signal master_secret as the hash, then use the mac_salt and passphrase_iterations in mode 12000.

Signal is popular - if hashcat cannot crack it should add support!