Reviewing the code

Clipperz online password manager has security foundations that are made of well known cryptographic algorithms: SRP, AES, SHA2, ECC and Fortuna. The strength of these crypto primitives cannot be questioned (at least, not with us!), but our Javascript implementations and Clipperz’s software architecture could present security flaws. This page explains how to conduct a review of Clipperz code.

Downloading the code

Clipperz is a quite unique and complex web application. The Javascript code does everything, from drawing the interface to execute the encryption routines.

Clipperz include portions of code from few third party libraries, such as: MochiKit, YUI and Ext to allows smoother and quicker coding.

In order to save downloading time and memory space the original Clipperz code is compressed into a large single file using Dojo ShrinkSafe.

This file is quite difficult, almost impossible to work with: spaces and comments have been removed, variables have been renamed. To make life easier to our code reviewers, we maintain a zipped folder with the source files in their original form and instructions on how to use them. Just click on the link below to download it to your hard disk.

This folder always contains the latest version, i.e. the code behind the application that is presently running on our servers. An archive with older versions is also available.

For any further information, please post a message to the Clipperz Forum.
Any question or suggestion is welcome!

Build environment

Starting with release 617, the source code of the application is bundled with all the stuff required to build the final index.html, the same exact file loaded when using the Clipperz application. The build process is managed using an Apache Ant “script”: build.xml.

Required stuff

Apache Ant

Apache Ant is a quite common build tool used mainly for Java applications, but its features are quite flexible and it could be easily adapted to many other batch tasks. Instructions on how to install Ant are available from the online manual. The Clipperz project is regularly build using Ant version 1.6.5, running on MacOSX.

Additional Ant tasks

Beside the standard Ant tasks, our script also invokes two external tools:

Package content

Once unpacked, the project folder contains the following items:

Running the script

To build the project, the Ant tool must be launched from the project folder containing the build.xml file. The default task is already setup, so it will just do the right thing. It is really this simple!

Expected output

The build script will put all the generated files into the _build folder, created beside the build.xml file. Inside the _build folder there should be two different folders:

The final index.html is the same exact file that is loaded into your browser when you access the Clipperz application; the checksums of this file should match the published checksum of the Clipperz application.

Older versions

Checksums

Every time you visit the Clipperz login page, your browser downloads about 1 MB of JavaScript code. This is the whole code of the Clipperz web application, the code that your browser will run while you enjoy Clipperz. This code takes care of everything you can do within Clipperz, from logging you in to signing you out.

Therefore it is critical to be sure that the downloaded code has not been tampered with. This page gives you some practical advice on checking the genuineness of your code.

Checksums and hash functions

A checksum (or digital fingerprint, or message digest) is a string of characters generated by special algorithms called “cryptographic hash functions”. These algorithms take a message (e.g. a text file) of any length as input and produces a fixed length string as output.

Good hash function are such that it’s very difficult to:

For these reasons it is a good idea to use checksums as handy identifiers of large objects such as text files, they could be seen as a condensed digital representation that is, to a high degree of probability, unique for a given input data sequence.

If a text file is modified the correspondent checksum will be completely different, even if only a single character has been changed.

To date the two most-commonly used hash functions are MD5 and SHA-1, producing respectively 128-bit and 160-bit outputs.

Hash example

How to compute the checksum of the Clipperz application

You need to perform the following two steps:

  1. save the page source to a file;
  2. run the hash function.

1. Save Clipperz source code to a file

For any other purpose, you could access the source code of any web page, by simply using the built browser functionality. Select “View > Page source” from the browser menus and then you could just copy the entire code to a file.

But in this case you need to be sure that not even a single character is added or changed. Therefore you should avoid the above procedure and opt for a safer method.

2. Compute the hash function of the Clipperz code

Locate the index.html file generated by the previous step on your hard disk.

Eventually, compare the values obtained with the ones available in the right column of the Clipperz web site. If they don’t match please report immediately.