Setup solution

ModernKeePassLib/Cryptography/Cipher/ChaCha20Cipher.cs

@@ -0,0 +1,254 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+
+using ModernKeePassLib.Resources;
+using ModernKeePassLib.Utility;
+
+namespace ModernKeePassLib.Cryptography.Cipher
+{
+	/// <summary>
+	/// Implementation of the ChaCha20 cipher with a 96-bit nonce,
+	/// as specified in RFC 7539.
+	/// https://tools.ietf.org/html/rfc7539
+	/// </summary>
+	public sealed class ChaCha20Cipher : CtrBlockCipher
+	{
+		private uint[] m_s = new uint[16]; // State
+		private uint[] m_x = new uint[16]; // Working buffer
+
+		private bool m_bLargeCounter; // See constructor documentation
+
+		private static readonly uint[] g_sigma = new uint[4] {
+			0x61707865, 0x3320646E, 0x79622D32, 0x6B206574
+		};
+
+		private const string StrNameRfc = "ChaCha20 (RFC 7539)";
+
+		public override int BlockSize
+		{
+			get { return 64; }
+		}
+
+		public ChaCha20Cipher(byte[] pbKey32, byte[] pbIV12) :
+			this(pbKey32, pbIV12, false)
+		{
+		}
+
+		/// <summary>
+		/// Constructor.
+		/// </summary>
+		/// <param name="pbKey32">Key (32 bytes).</param>
+		/// <param name="pbIV12">Nonce (12 bytes).</param>
+		/// <param name="bLargeCounter">If <c>false</c>, the RFC 7539 version
+		/// of ChaCha20 is used. In this case, only 256 GB of data can be
+		/// encrypted securely (because the block counter is a 32-bit variable);
+		/// an attempt to encrypt more data throws an exception.
+		/// If <paramref name="bLargeCounter" /> is <c>true</c>, the 32-bit
+		/// counter overflows to another 32-bit variable (i.e. the counter
+		/// effectively is a 64-bit variable), like in the original ChaCha20
+		/// specification by D. J. Bernstein (which has a 64-bit counter and a
+		/// 64-bit nonce). To be compatible with this version, the 64-bit nonce
+		/// must be stored in the last 8 bytes of <paramref name="pbIV12" />
+		/// and the first 4 bytes must be 0.
+		/// If the IV was generated randomly, a 12-byte IV and a large counter
+		/// can be used to securely encrypt more than 256 GB of data (but note
+		/// this is incompatible with RFC 7539 and the original specification).</param>
+		public ChaCha20Cipher(byte[] pbKey32, byte[] pbIV12, bool bLargeCounter) :
+			base()
+		{
+			if(pbKey32 == null) throw new ArgumentNullException("pbKey32");
+			if(pbKey32.Length != 32) throw new ArgumentOutOfRangeException("pbKey32");
+			if(pbIV12 == null) throw new ArgumentNullException("pbIV12");
+			if(pbIV12.Length != 12) throw new ArgumentOutOfRangeException("pbIV12");
+
+			m_bLargeCounter = bLargeCounter;
+
+			// Key setup
+			m_s[4] = MemUtil.BytesToUInt32(pbKey32, 0);
+			m_s[5] = MemUtil.BytesToUInt32(pbKey32, 4);
+			m_s[6] = MemUtil.BytesToUInt32(pbKey32, 8);
+			m_s[7] = MemUtil.BytesToUInt32(pbKey32, 12);
+			m_s[8] = MemUtil.BytesToUInt32(pbKey32, 16);
+			m_s[9] = MemUtil.BytesToUInt32(pbKey32, 20);
+			m_s[10] = MemUtil.BytesToUInt32(pbKey32, 24);
+			m_s[11] = MemUtil.BytesToUInt32(pbKey32, 28);
+			m_s[0] = g_sigma[0];
+			m_s[1] = g_sigma[1];
+			m_s[2] = g_sigma[2];
+			m_s[3] = g_sigma[3];
+
+			// IV setup
+			m_s[12] = 0; // Counter
+			m_s[13] = MemUtil.BytesToUInt32(pbIV12, 0);
+			m_s[14] = MemUtil.BytesToUInt32(pbIV12, 4);
+			m_s[15] = MemUtil.BytesToUInt32(pbIV12, 8);
+		}
+
+		protected override void Dispose(bool bDisposing)
+		{
+			if(bDisposing)
+			{
+				MemUtil.ZeroArray<uint>(m_s);
+				MemUtil.ZeroArray<uint>(m_x);
+			}
+
+			base.Dispose(bDisposing);
+		}
+
+		protected override void NextBlock(byte[] pBlock)
+		{
+			if(pBlock == null) throw new ArgumentNullException("pBlock");
+			if(pBlock.Length != 64) throw new ArgumentOutOfRangeException("pBlock");
+
+			// x is a local alias for the working buffer; with this,
+			// the compiler/runtime might remove some checks
+			uint[] x = m_x;
+			if(x == null) throw new InvalidOperationException();
+			if(x.Length < 16) throw new InvalidOperationException();
+
+			uint[] s = m_s;
+			if(s == null) throw new InvalidOperationException();
+			if(s.Length < 16) throw new InvalidOperationException();
+
+			Array.Copy(s, x, 16);
+
+			unchecked
+			{
+				// 10 * 8 quarter rounds = 20 rounds
+				for(int i = 0; i < 10; ++i)
+				{
+					// Column quarter rounds
+					x[ 0] += x[ 4];
+					x[12] = MemUtil.RotateLeft32(x[12] ^ x[ 0], 16);
+					x[ 8] += x[12];
+					x[ 4] = MemUtil.RotateLeft32(x[ 4] ^ x[ 8], 12);
+					x[ 0] += x[ 4];
+					x[12] = MemUtil.RotateLeft32(x[12] ^ x[ 0], 8);
+					x[ 8] += x[12];
+					x[ 4] = MemUtil.RotateLeft32(x[ 4] ^ x[ 8], 7);
+
+					x[ 1] += x[ 5];
+					x[13] = MemUtil.RotateLeft32(x[13] ^ x[ 1], 16);
+					x[ 9] += x[13];
+					x[ 5] = MemUtil.RotateLeft32(x[ 5] ^ x[ 9], 12);
+					x[ 1] += x[ 5];
+					x[13] = MemUtil.RotateLeft32(x[13] ^ x[ 1], 8);
+					x[ 9] += x[13];
+					x[ 5] = MemUtil.RotateLeft32(x[ 5] ^ x[ 9], 7);
+
+					x[ 2] += x[ 6];
+					x[14] = MemUtil.RotateLeft32(x[14] ^ x[ 2], 16);
+					x[10] += x[14];
+					x[ 6] = MemUtil.RotateLeft32(x[ 6] ^ x[10], 12);
+					x[ 2] += x[ 6];
+					x[14] = MemUtil.RotateLeft32(x[14] ^ x[ 2], 8);
+					x[10] += x[14];
+					x[ 6] = MemUtil.RotateLeft32(x[ 6] ^ x[10], 7);
+
+					x[ 3] += x[ 7];
+					x[15] = MemUtil.RotateLeft32(x[15] ^ x[ 3], 16);
+					x[11] += x[15];
+					x[ 7] = MemUtil.RotateLeft32(x[ 7] ^ x[11], 12);
+					x[ 3] += x[ 7];
+					x[15] = MemUtil.RotateLeft32(x[15] ^ x[ 3], 8);
+					x[11] += x[15];
+					x[ 7] = MemUtil.RotateLeft32(x[ 7] ^ x[11], 7);
+
+					// Diagonal quarter rounds
+					x[ 0] += x[ 5];
+					x[15] = MemUtil.RotateLeft32(x[15] ^ x[ 0], 16);
+					x[10] += x[15];
+					x[ 5] = MemUtil.RotateLeft32(x[ 5] ^ x[10], 12);
+					x[ 0] += x[ 5];
+					x[15] = MemUtil.RotateLeft32(x[15] ^ x[ 0],  8);
+					x[10] += x[15];
+					x[ 5] = MemUtil.RotateLeft32(x[ 5] ^ x[10],  7);
+
+					x[ 1] += x[ 6];
+					x[12] = MemUtil.RotateLeft32(x[12] ^ x[ 1], 16);
+					x[11] += x[12];
+					x[ 6] = MemUtil.RotateLeft32(x[ 6] ^ x[11], 12);
+					x[ 1] += x[ 6];
+					x[12] = MemUtil.RotateLeft32(x[12] ^ x[ 1],  8);
+					x[11] += x[12];
+					x[ 6] = MemUtil.RotateLeft32(x[ 6] ^ x[11],  7);
+
+					x[ 2] += x[ 7];
+					x[13] = MemUtil.RotateLeft32(x[13] ^ x[ 2], 16);
+					x[ 8] += x[13];
+					x[ 7] = MemUtil.RotateLeft32(x[ 7] ^ x[ 8], 12);
+					x[ 2] += x[ 7];
+					x[13] = MemUtil.RotateLeft32(x[13] ^ x[ 2],  8);
+					x[ 8] += x[13];
+					x[ 7] = MemUtil.RotateLeft32(x[ 7] ^ x[ 8],  7);
+
+					x[ 3] += x[ 4];
+					x[14] = MemUtil.RotateLeft32(x[14] ^ x[ 3], 16);
+					x[ 9] += x[14];
+					x[ 4] = MemUtil.RotateLeft32(x[ 4] ^ x[ 9], 12);
+					x[ 3] += x[ 4];
+					x[14] = MemUtil.RotateLeft32(x[14] ^ x[ 3],  8);
+					x[ 9] += x[14];
+					x[ 4] = MemUtil.RotateLeft32(x[ 4] ^ x[ 9],  7);
+				}
+
+				for(int i = 0; i < 16; ++i) x[i] += s[i];
+
+				for(int i = 0; i < 16; ++i)
+				{
+					int i4 = i << 2;
+					uint xi = x[i];
+
+					pBlock[i4] = (byte)xi;
+					pBlock[i4 + 1] = (byte)(xi >> 8);
+					pBlock[i4 + 2] = (byte)(xi >> 16);
+					pBlock[i4 + 3] = (byte)(xi >> 24);
+				}
+
+				++s[12];
+				if(s[12] == 0)
+				{
+					if(!m_bLargeCounter)
+						throw new InvalidOperationException(
+							KLRes.EncDataTooLarge.Replace(@"{PARAM}", StrNameRfc));
+					++s[13]; // Increment high half of large counter
+				}
+			}
+		}
+
+		public long Seek(long lOffset, SeekOrigin so)
+		{
+			if(so != SeekOrigin.Begin) throw new NotSupportedException();
+
+			if((lOffset < 0) || ((lOffset & 63) != 0) ||
+				((lOffset >> 6) > (long)uint.MaxValue))
+				throw new ArgumentOutOfRangeException("lOffset");
+
+			m_s[12] = (uint)(lOffset >> 6);
+			InvalidateBlock();
+
+			return lOffset;
+		}
+	}
+}

ModernKeePassLib/Cryptography/Cipher/ChaCha20Engine.cs

@@ -0,0 +1,176 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Text;
+
+using ModernKeePassLib.Resources;
+
+namespace ModernKeePassLib.Cryptography.Cipher
+{
+	public sealed class ChaCha20Engine : ICipherEngine2
+	{
+		private PwUuid m_uuid = new PwUuid(new byte[] {
+			0xD6, 0x03, 0x8A, 0x2B, 0x8B, 0x6F, 0x4C, 0xB5,
+			0xA5, 0x24, 0x33, 0x9A, 0x31, 0xDB, 0xB5, 0x9A
+		});
+		public PwUuid CipherUuid
+		{
+			get { return m_uuid; }
+		}
+
+		public string DisplayName
+		{
+			get
+			{
+				return ("ChaCha20 (" + KLRes.KeyBits.Replace(@"{PARAM}",
+					"256") + ", RFC 7539)");
+			}
+		}
+
+		public int KeyLength
+		{
+			get { return 32; }
+		}
+
+		public int IVLength
+		{
+			get { return 12; } // 96 bits
+		}
+
+		public Stream EncryptStream(Stream s, byte[] pbKey, byte[] pbIV)
+		{
+			return new ChaCha20Stream(s, true, pbKey, pbIV);
+		}
+
+		public Stream DecryptStream(Stream s, byte[] pbKey, byte[] pbIV)
+		{
+			return new ChaCha20Stream(s, false, pbKey, pbIV);
+		}
+	}
+
+	public sealed class ChaCha20Stream : Stream
+	{
+		private Stream m_sBase;
+		private readonly bool m_bWriting;
+		private ChaCha20Cipher m_c;
+
+		private byte[] m_pbBuffer = null;
+
+		public override bool CanRead
+		{
+			get { return !m_bWriting; }
+		}
+
+		public override bool CanSeek
+		{
+			get { return false; }
+		}
+
+		public override bool CanWrite
+		{
+			get { return m_bWriting; }
+		}
+
+		public override long Length
+		{
+			get { Debug.Assert(false); throw new NotSupportedException(); }
+		}
+
+		public override long Position
+		{
+			get { Debug.Assert(false); throw new NotSupportedException(); }
+			set { Debug.Assert(false); throw new NotSupportedException(); }
+		}
+
+		public ChaCha20Stream(Stream sBase, bool bWriting, byte[] pbKey32,
+			byte[] pbIV12)
+		{
+			if(sBase == null) throw new ArgumentNullException("sBase");
+
+			m_sBase = sBase;
+			m_bWriting = bWriting;
+			m_c = new ChaCha20Cipher(pbKey32, pbIV12);
+		}
+
+		protected override void Dispose(bool bDisposing)
+		{
+			if(bDisposing)
+			{
+				if(m_sBase != null)
+				{
+					m_c.Dispose();
+					m_c = null;
+
+					m_sBase.Dispose();
+					m_sBase = null;
+				}
+
+				m_pbBuffer = null;
+			}
+
+			base.Dispose(bDisposing);
+		}
+
+		public override void Flush()
+		{
+			Debug.Assert(m_sBase != null);
+			if(m_bWriting && (m_sBase != null)) m_sBase.Flush();
+		}
+
+		public override long Seek(long lOffset, SeekOrigin soOrigin)
+		{
+			Debug.Assert(false);
+			throw new NotImplementedException();
+		}
+
+		public override void SetLength(long lValue)
+		{
+			Debug.Assert(false);
+			throw new NotImplementedException();
+		}
+
+		public override int Read(byte[] pbBuffer, int iOffset, int nCount)
+		{
+			if(m_bWriting) throw new InvalidOperationException();
+
+			int cbRead = m_sBase.Read(pbBuffer, iOffset, nCount);
+			m_c.Decrypt(pbBuffer, iOffset, cbRead);
+			return cbRead;
+		}
+
+		public override void Write(byte[] pbBuffer, int iOffset, int nCount)
+		{
+			if(nCount < 0) throw new ArgumentOutOfRangeException("nCount");
+			if(nCount == 0) return;
+
+			if(!m_bWriting) throw new InvalidOperationException();
+
+			if((m_pbBuffer == null) || (m_pbBuffer.Length < nCount))
+				m_pbBuffer = new byte[nCount];
+			Array.Copy(pbBuffer, iOffset, m_pbBuffer, 0, nCount);
+
+			m_c.Encrypt(m_pbBuffer, 0, nCount);
+			m_sBase.Write(m_pbBuffer, 0, nCount);
+		}
+	}
+}

ModernKeePassLib/Cryptography/Cipher/CipherPool.cs

@@ -0,0 +1,165 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Text;
+
+namespace ModernKeePassLib.Cryptography.Cipher
+{
+	/// <summary>
+	/// Pool of encryption/decryption algorithms (ciphers).
+	/// </summary>
+	public sealed class CipherPool
+	{
+		private List<ICipherEngine> m_lCiphers = new List<ICipherEngine>();
+
+		private static CipherPool m_poolGlobal = null;
+		public static CipherPool GlobalPool
+		{
+			get
+			{
+				CipherPool cp = m_poolGlobal;
+				if(cp == null)
+				{
+					cp = new CipherPool();
+					cp.AddCipher(new StandardAesEngine());
+					cp.AddCipher(new ChaCha20Engine());
+
+					m_poolGlobal = cp;
+				}
+
+				return cp;
+			}
+		}
+
+		/// <summary>
+		/// Remove all cipher engines from the current pool.
+		/// </summary>
+		public void Clear()
+		{
+			m_lCiphers.Clear();
+		}
+
+		/// <summary>
+		/// Add a cipher engine to the pool.
+		/// </summary>
+		/// <param name="c">Cipher engine to add. Must not be <c>null</c>.</param>
+		public void AddCipher(ICipherEngine c)
+		{
+			if(c == null) { Debug.Assert(false); throw new ArgumentNullException("c"); }
+
+			// Return if a cipher with that ID is registered already
+			foreach(ICipherEngine cEx in m_lCiphers)
+			{
+				if(cEx.CipherUuid.Equals(c.CipherUuid))
+					return;
+			}
+
+			m_lCiphers.Add(c);
+		}
+
+		/// <summary>
+		/// Get a cipher identified by its UUID.
+		/// </summary>
+		/// <param name="uuidCipher">UUID of the cipher to return.</param>
+		/// <returns>Reference to the requested cipher. If the cipher is
+		/// not found, <c>null</c> is returned.</returns>
+		public ICipherEngine GetCipher(PwUuid uuidCipher)
+		{
+			foreach(ICipherEngine c in m_lCiphers)
+			{
+				if(c.CipherUuid.Equals(uuidCipher))
+					return c;
+			}
+
+			return null;
+		}
+
+		/// <summary>
+		/// Get the index of a cipher. This index is temporary and should
+		/// not be stored or used to identify a cipher.
+		/// </summary>
+		/// <param name="uuidCipher">UUID of the cipher.</param>
+		/// <returns>Index of the requested cipher. Returns <c>-1</c> if
+		/// the specified cipher is not found.</returns>
+		public int GetCipherIndex(PwUuid uuidCipher)
+		{
+			for(int i = 0; i < m_lCiphers.Count; ++i)
+			{
+				if(m_lCiphers[i].CipherUuid.Equals(uuidCipher))
+					return i;
+			}
+
+			Debug.Assert(false);
+			return -1;
+		}
+
+		/// <summary>
+		/// Get the index of a cipher. This index is temporary and should
+		/// not be stored or used to identify a cipher.
+		/// </summary>
+		/// <param name="strDisplayName">Name of the cipher. Note that
+		/// multiple ciphers can have the same name. In this case, the
+		/// first matching cipher is returned.</param>
+		/// <returns>Cipher with the specified name or <c>-1</c> if
+		/// no cipher with that name is found.</returns>
+		public int GetCipherIndex(string strDisplayName)
+		{
+			for(int i = 0; i < m_lCiphers.Count; ++i)
+			{
+				if(m_lCiphers[i].DisplayName == strDisplayName)
+					return i;
+			}
+
+			Debug.Assert(false);
+			return -1;
+		}
+
+		/// <summary>
+		/// Get the number of cipher engines in this pool.
+		/// </summary>
+		public int EngineCount
+		{
+			get { return m_lCiphers.Count; }
+		}
+
+		/// <summary>
+		/// Get the cipher engine at the specified position. Throws
+		/// an exception if the index is invalid. You can use this
+		/// to iterate over all ciphers, but do not use it to
+		/// identify ciphers.
+		/// </summary>
+		/// <param name="nIndex">Index of the requested cipher engine.</param>
+		/// <returns>Reference to the cipher engine at the specified
+		/// position.</returns>
+		public ICipherEngine this[int nIndex]
+		{
+			get
+			{
+				if((nIndex < 0) || (nIndex >= m_lCiphers.Count))
+					throw new ArgumentOutOfRangeException("nIndex");
+
+				return m_lCiphers[nIndex];
+			}
+		}
+	}
+}

ModernKeePassLib/Cryptography/Cipher/CtrBlockCipher.cs

@@ -0,0 +1,109 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Text;
+
+using ModernKeePassLib.Utility;
+
+namespace ModernKeePassLib.Cryptography.Cipher
+{
+	public abstract class CtrBlockCipher : IDisposable
+	{
+		private bool m_bDisposed = false;
+
+		private byte[] m_pBlock;
+		private int m_iBlockPos;
+
+		public abstract int BlockSize
+		{
+			get;
+		}
+
+		public CtrBlockCipher()
+		{
+			int cb = this.BlockSize;
+			if(cb <= 0) throw new InvalidOperationException("this.BlockSize");
+
+			m_pBlock = new byte[cb];
+			m_iBlockPos = cb;
+		}
+
+		public void Dispose()
+		{
+			Dispose(true);
+			GC.SuppressFinalize(this);
+		}
+
+		protected virtual void Dispose(bool bDisposing)
+		{
+			if(bDisposing)
+			{
+				MemUtil.ZeroByteArray(m_pBlock);
+				m_iBlockPos = m_pBlock.Length;
+
+				m_bDisposed = true;
+			}
+		}
+
+		protected void InvalidateBlock()
+		{
+			m_iBlockPos = m_pBlock.Length;
+		}
+
+		protected abstract void NextBlock(byte[] pBlock);
+
+		public void Encrypt(byte[] m, int iOffset, int cb)
+		{
+			if(m_bDisposed) throw new ObjectDisposedException(null);
+			if(m == null) throw new ArgumentNullException("m");
+			if(iOffset < 0) throw new ArgumentOutOfRangeException("iOffset");
+			if(cb < 0) throw new ArgumentOutOfRangeException("cb");
+			if(iOffset > (m.Length - cb)) throw new ArgumentOutOfRangeException("cb");
+
+			int cbBlock = m_pBlock.Length;
+
+			while(cb > 0)
+			{
+				Debug.Assert(m_iBlockPos <= cbBlock);
+				if(m_iBlockPos == cbBlock)
+				{
+					NextBlock(m_pBlock);
+					m_iBlockPos = 0;
+				}
+
+				int cbCopy = Math.Min(cbBlock - m_iBlockPos, cb);
+				Debug.Assert(cbCopy > 0);
+
+				MemUtil.XorArray(m_pBlock, m_iBlockPos, m, iOffset, cbCopy);
+
+				m_iBlockPos += cbCopy;
+				iOffset += cbCopy;
+				cb -= cbCopy;
+			}
+		}
+
+		public void Decrypt(byte[] m, int iOffset, int cb)
+		{
+			Encrypt(m, iOffset, cb);
+		}
+	}
+}

ModernKeePassLib/Cryptography/Cipher/ICipherEngine.cs

@@ -0,0 +1,69 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.IO;
+
+namespace ModernKeePassLib.Cryptography.Cipher
+{
+	public interface ICipherEngine
+	{
+		/// <summary>
+		/// UUID of the engine. If you want to write an engine/plugin,
+		/// please contact the KeePass team to obtain a new UUID.
+		/// </summary>
+		PwUuid CipherUuid
+		{
+			get;
+		}
+
+		/// <summary>
+		/// Name displayed in the list of available encryption/decryption
+		/// engines in the GUI.
+		/// </summary>
+		string DisplayName
+		{
+			get;
+		}
+
+		Stream EncryptStream(Stream s, byte[] pbKey, byte[] pbIV);
+		Stream DecryptStream(Stream s, byte[] pbKey, byte[] pbIV);
+	}
+
+	public interface ICipherEngine2 : ICipherEngine
+	{
+		/// <summary>
+		/// Length of an encryption key in bytes.
+		/// The base <c>ICipherEngine</c> assumes 32.
+		/// </summary>
+		int KeyLength
+		{
+			get;
+		}
+
+		/// <summary>
+		/// Length of the initialization vector in bytes.
+		/// The base <c>ICipherEngine</c> assumes 16.
+		/// </summary>
+		int IVLength
+		{
+			get;
+		}
+	}
+}

ModernKeePassLib/Cryptography/Cipher/Salsa20Cipher.cs

@@ -0,0 +1,165 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+// Implementation of the Salsa20 cipher, based on the eSTREAM
+// submission by D. J. Bernstein.
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+
+using ModernKeePassLib.Utility;
+
+namespace ModernKeePassLib.Cryptography.Cipher
+{
+	public sealed class Salsa20Cipher : CtrBlockCipher
+	{
+		private uint[] m_s = new uint[16]; // State
+		private uint[] m_x = new uint[16]; // Working buffer
+
+		private static readonly uint[] g_sigma = new uint[4] {
+			0x61707865, 0x3320646E, 0x79622D32, 0x6B206574
+		};
+
+		public override int BlockSize
+		{
+			get { return 64; }
+		}
+
+		public Salsa20Cipher(byte[] pbKey32, byte[] pbIV8) : base()
+		{
+			if(pbKey32 == null) throw new ArgumentNullException("pbKey32");
+			if(pbKey32.Length != 32) throw new ArgumentOutOfRangeException("pbKey32");
+			if(pbIV8 == null) throw new ArgumentNullException("pbIV8");
+			if(pbIV8.Length != 8) throw new ArgumentOutOfRangeException("pbIV8");
+
+			// Key setup
+			m_s[1] = MemUtil.BytesToUInt32(pbKey32, 0);
+			m_s[2] = MemUtil.BytesToUInt32(pbKey32, 4);
+			m_s[3] = MemUtil.BytesToUInt32(pbKey32, 8);
+			m_s[4] = MemUtil.BytesToUInt32(pbKey32, 12);
+			m_s[11] = MemUtil.BytesToUInt32(pbKey32, 16);
+			m_s[12] = MemUtil.BytesToUInt32(pbKey32, 20);
+			m_s[13] = MemUtil.BytesToUInt32(pbKey32, 24);
+			m_s[14] = MemUtil.BytesToUInt32(pbKey32, 28);
+			m_s[0] = g_sigma[0];
+			m_s[5] = g_sigma[1];
+			m_s[10] = g_sigma[2];
+			m_s[15] = g_sigma[3];
+
+			// IV setup
+			m_s[6] = MemUtil.BytesToUInt32(pbIV8, 0);
+			m_s[7] = MemUtil.BytesToUInt32(pbIV8, 4);
+			m_s[8] = 0; // Counter, low
+			m_s[9] = 0; // Counter, high
+		}
+
+		protected override void Dispose(bool bDisposing)
+		{
+			if(bDisposing)
+			{
+				MemUtil.ZeroArray<uint>(m_s);
+				MemUtil.ZeroArray<uint>(m_x);
+			}
+
+			base.Dispose(bDisposing);
+		}
+
+		protected override void NextBlock(byte[] pBlock)
+		{
+			if(pBlock == null) throw new ArgumentNullException("pBlock");
+			if(pBlock.Length != 64) throw new ArgumentOutOfRangeException("pBlock");
+
+			// x is a local alias for the working buffer; with this,
+			// the compiler/runtime might remove some checks
+			uint[] x = m_x;
+			if(x == null) throw new InvalidOperationException();
+			if(x.Length < 16) throw new InvalidOperationException();
+
+			uint[] s = m_s;
+			if(s == null) throw new InvalidOperationException();
+			if(s.Length < 16) throw new InvalidOperationException();
+
+			Array.Copy(s, x, 16);
+
+			unchecked
+			{
+				// 10 * 8 quarter rounds = 20 rounds
+				for(int i = 0; i < 10; ++i)
+				{
+					x[ 4] ^= MemUtil.RotateLeft32(x[ 0] + x[12],  7);
+					x[ 8] ^= MemUtil.RotateLeft32(x[ 4] + x[ 0],  9);
+					x[12] ^= MemUtil.RotateLeft32(x[ 8] + x[ 4], 13);
+					x[ 0] ^= MemUtil.RotateLeft32(x[12] + x[ 8], 18);
+
+					x[ 9] ^= MemUtil.RotateLeft32(x[ 5] + x[ 1],  7);
+					x[13] ^= MemUtil.RotateLeft32(x[ 9] + x[ 5],  9);
+					x[ 1] ^= MemUtil.RotateLeft32(x[13] + x[ 9], 13);
+					x[ 5] ^= MemUtil.RotateLeft32(x[ 1] + x[13], 18);
+
+					x[14] ^= MemUtil.RotateLeft32(x[10] + x[ 6],  7);
+					x[ 2] ^= MemUtil.RotateLeft32(x[14] + x[10],  9);
+					x[ 6] ^= MemUtil.RotateLeft32(x[ 2] + x[14], 13);
+					x[10] ^= MemUtil.RotateLeft32(x[ 6] + x[ 2], 18);
+
+					x[ 3] ^= MemUtil.RotateLeft32(x[15] + x[11],  7);
+					x[ 7] ^= MemUtil.RotateLeft32(x[ 3] + x[15],  9);
+					x[11] ^= MemUtil.RotateLeft32(x[ 7] + x[ 3], 13);
+					x[15] ^= MemUtil.RotateLeft32(x[11] + x[ 7], 18);
+
+					x[ 1] ^= MemUtil.RotateLeft32(x[ 0] + x[ 3],  7);
+					x[ 2] ^= MemUtil.RotateLeft32(x[ 1] + x[ 0],  9);
+					x[ 3] ^= MemUtil.RotateLeft32(x[ 2] + x[ 1], 13);
+					x[ 0] ^= MemUtil.RotateLeft32(x[ 3] + x[ 2], 18);
+
+					x[ 6] ^= MemUtil.RotateLeft32(x[ 5] + x[ 4],  7);
+					x[ 7] ^= MemUtil.RotateLeft32(x[ 6] + x[ 5],  9);
+					x[ 4] ^= MemUtil.RotateLeft32(x[ 7] + x[ 6], 13);
+					x[ 5] ^= MemUtil.RotateLeft32(x[ 4] + x[ 7], 18);
+
+					x[11] ^= MemUtil.RotateLeft32(x[10] + x[ 9],  7);
+					x[ 8] ^= MemUtil.RotateLeft32(x[11] + x[10],  9);
+					x[ 9] ^= MemUtil.RotateLeft32(x[ 8] + x[11], 13);
+					x[10] ^= MemUtil.RotateLeft32(x[ 9] + x[ 8], 18);
+
+					x[12] ^= MemUtil.RotateLeft32(x[15] + x[14],  7);
+					x[13] ^= MemUtil.RotateLeft32(x[12] + x[15],  9);
+					x[14] ^= MemUtil.RotateLeft32(x[13] + x[12], 13);
+					x[15] ^= MemUtil.RotateLeft32(x[14] + x[13], 18);
+				}
+
+				for(int i = 0; i < 16; ++i) x[i] += s[i];
+
+				for(int i = 0; i < 16; ++i)
+				{
+					int i4 = i << 2;
+					uint xi = x[i];
+
+					pBlock[i4] = (byte)xi;
+					pBlock[i4 + 1] = (byte)(xi >> 8);
+					pBlock[i4 + 2] = (byte)(xi >> 16);
+					pBlock[i4 + 3] = (byte)(xi >> 24);
+				}
+
+				++s[8];
+				if(s[8] == 0) ++s[9];
+			}
+		}
+	}
+}

ModernKeePassLib/Cryptography/Cipher/StandardAesEngine.cs

@@ -0,0 +1,133 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Security;
+using System.Text;
+
+#if !KeePassUAP
+using System.Security.Cryptography;
+#endif
+
+using ModernKeePassLib.Resources;
+
+namespace ModernKeePassLib.Cryptography.Cipher
+{
+	public sealed class StandardAesEngine : ICipherEngine
+	{
+#if !KeePassUAP
+		private const CipherMode SaeCipherMode = CipherMode.CBC;
+		private const PaddingMode SaePaddingMode = PaddingMode.PKCS7;
+#endif
+
+		private static PwUuid g_uuidAes = null;
+		public static PwUuid AesUuid
+		{
+			get
+			{
+				PwUuid pu = g_uuidAes;
+				if(pu == null)
+				{
+					pu = new PwUuid(new byte[] {
+						0x31, 0xC1, 0xF2, 0xE6, 0xBF, 0x71, 0x43, 0x50,
+						0xBE, 0x58, 0x05, 0x21, 0x6A, 0xFC, 0x5A, 0xFF });
+					g_uuidAes = pu;
+				}
+
+				return pu;
+			}
+		}
+
+		public PwUuid CipherUuid
+		{
+			get { return StandardAesEngine.AesUuid; }
+		}
+
+		public string DisplayName
+		{
+			get
+			{
+				return ("AES/Rijndael (" + KLRes.KeyBits.Replace(@"{PARAM}",
+					"256") + ", FIPS 197)");
+			}
+		}
+
+		private static void ValidateArguments(Stream s, bool bEncrypt, byte[] pbKey, byte[] pbIV)
+		{
+			if(s == null) { Debug.Assert(false); throw new ArgumentNullException("s"); }
+
+			if(pbKey == null) { Debug.Assert(false); throw new ArgumentNullException("pbKey"); }
+			if(pbKey.Length != 32) { Debug.Assert(false); throw new ArgumentOutOfRangeException("pbKey"); }
+
+			if(pbIV == null) { Debug.Assert(false); throw new ArgumentNullException("pbIV"); }
+			if(pbIV.Length != 16) { Debug.Assert(false); throw new ArgumentOutOfRangeException("pbIV"); }
+
+			if(bEncrypt)
+			{
+				Debug.Assert(s.CanWrite);
+				if(!s.CanWrite) throw new ArgumentException("Stream must be writable!");
+			}
+			else // Decrypt
+			{
+				Debug.Assert(s.CanRead);
+				if(!s.CanRead) throw new ArgumentException("Stream must be readable!");
+			}
+		}
+
+		private static Stream CreateStream(Stream s, bool bEncrypt, byte[] pbKey, byte[] pbIV)
+		{
+			StandardAesEngine.ValidateArguments(s, bEncrypt, pbKey, pbIV);
+
+#if KeePassUAP
+			return StandardAesEngineExt.CreateStream(s, bEncrypt, pbKey, pbIV);
+#else
+			SymmetricAlgorithm a = CryptoUtil.CreateAes();
+			if(a.BlockSize != 128) // AES block size
+			{
+				Debug.Assert(false);
+				a.BlockSize = 128;
+			}
+			a.KeySize = 256;
+			a.Mode = SaeCipherMode;
+			a.Padding = SaePaddingMode;
+
+			ICryptoTransform t;
+			if(bEncrypt) t = a.CreateEncryptor(pbKey, pbIV);
+			else t = a.CreateDecryptor(pbKey, pbIV);
+			if(t == null) { Debug.Assert(false); throw new SecurityException("Unable to create AES transform!"); }
+
+			return new CryptoStreamEx(s, t, bEncrypt ? CryptoStreamMode.Write :
+				CryptoStreamMode.Read, a);
+#endif
+		}
+
+		public Stream EncryptStream(Stream s, byte[] pbKey, byte[] pbIV)
+		{
+			return StandardAesEngine.CreateStream(s, true, pbKey, pbIV);
+		}
+
+		public Stream DecryptStream(Stream s, byte[] pbKey, byte[] pbIV)
+		{
+			return StandardAesEngine.CreateStream(s, false, pbKey, pbIV);
+		}
+	}
+}

ModernKeePassLib/Cryptography/CryptoRandom.cs

@@ -0,0 +1,387 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Globalization;
+using System.IO;
+
+#if !KeePassUAP
+using System.Drawing;
+using System.Security.Cryptography;
+#endif
+#if !ModernKeePassLib
+using System.Windows.Forms;
+#endif
+
+using ModernKeePassLib.Delegates;
+using ModernKeePassLib.Native;
+using ModernKeePassLib.Security;
+using ModernKeePassLib.Utility;
+
+namespace ModernKeePassLib.Cryptography
+{
+	/// <summary>
+	/// Cryptographically secure pseudo-random number generator.
+	/// The returned values are unpredictable and cannot be reproduced.
+	/// <c>CryptoRandom</c> is a singleton class.
+	/// </summary>
+	public sealed class CryptoRandom
+	{
+		private ProtectedBinary m_pbEntropyPool = new ProtectedBinary(
+			true, new byte[64]);
+		private RNGCryptoServiceProvider m_rng = new RNGCryptoServiceProvider();
+		private ulong m_uCounter;
+		private ulong m_uGeneratedBytesCount = 0;
+
+		private static readonly object g_oSyncRoot = new object();
+		private readonly object m_oSyncRoot = new object();
+
+		private static CryptoRandom g_pInstance = null;
+		public static CryptoRandom Instance
+		{
+			get
+			{
+				CryptoRandom cr;
+				lock(g_oSyncRoot)
+				{
+					cr = g_pInstance;
+					if(cr == null)
+					{
+						cr = new CryptoRandom();
+						g_pInstance = cr;
+					}
+				}
+
+				return cr;
+			}
+		}
+
+		/// <summary>
+		/// Get the number of random bytes that this instance generated so far.
+		/// Note that this number can be higher than the number of random bytes
+		/// actually requested using the <c>GetRandomBytes</c> method.
+		/// </summary>
+		public ulong GeneratedBytesCount
+		{
+			get
+			{
+				ulong u;
+				lock(m_oSyncRoot) { u = m_uGeneratedBytesCount; }
+				return u;
+			}
+		}
+
+		/// <summary>
+		/// Event that is triggered whenever the internal <c>GenerateRandom256</c>
+		/// method is called to generate random bytes.
+		/// </summary>
+		public event EventHandler GenerateRandom256Pre;
+
+		private CryptoRandom()
+		{
+			m_uCounter = (ulong)DateTime.UtcNow.ToBinary();
+
+			byte[] pb = GetSystemEntropy();
+			AddEntropy(pb);
+			MemUtil.ZeroByteArray(pb);
+		}
+
+		/// <summary>
+		/// Update the internal seed of the random number generator based
+		/// on entropy data.
+		/// This method is thread-safe.
+		/// </summary>
+		/// <param name="pbEntropy">Entropy bytes.</param>
+		public void AddEntropy(byte[] pbEntropy)
+		{
+			if(pbEntropy == null) { Debug.Assert(false); return; }
+			if(pbEntropy.Length == 0) { Debug.Assert(false); return; }
+
+			byte[] pbNewData = pbEntropy;
+			if(pbEntropy.Length > 64)
+			{
+#if KeePassLibSD
+				using(SHA256Managed shaNew = new SHA256Managed())
+#else
+				using(SHA512Managed shaNew = new SHA512Managed())
+#endif
+				{
+					pbNewData = shaNew.ComputeHash(pbEntropy);
+				}
+			}
+
+			lock(m_oSyncRoot)
+			{
+				byte[] pbPool = m_pbEntropyPool.ReadData();
+				int cbPool = pbPool.Length;
+				int cbNew = pbNewData.Length;
+
+				byte[] pbCmp = new byte[cbPool + cbNew];
+				Array.Copy(pbPool, pbCmp, cbPool);
+				Array.Copy(pbNewData, 0, pbCmp, cbPool, cbNew);
+
+#if KeePassLibSD
+				using(SHA256Managed shaPool = new SHA256Managed())
+#else
+				using(SHA512Managed shaPool = new SHA512Managed())
+#endif
+				{
+					byte[] pbNewPool = shaPool.ComputeHash(pbCmp);
+					m_pbEntropyPool = new ProtectedBinary(true, pbNewPool);
+					MemUtil.ZeroByteArray(pbNewPool);
+				}
+
+				MemUtil.ZeroByteArray(pbCmp);
+				MemUtil.ZeroByteArray(pbPool);
+			}
+
+			if(pbNewData != pbEntropy) MemUtil.ZeroByteArray(pbNewData);
+		}
+
+		private byte[] GetSystemEntropy()
+		{
+			SHA512Managed h = new SHA512Managed();
+			byte[] pb4 = new byte[4];
+			byte[] pb8 = new byte[8];
+
+			GAction<byte[], bool> f = delegate(byte[] pbValue, bool bClearValue)
+			{
+				if(pbValue == null) { Debug.Assert(false); return; }
+				if(pbValue.Length == 0) return;
+				h.TransformBlock(pbValue, 0, pbValue.Length, pbValue, 0);
+				if(bClearValue) MemUtil.ZeroByteArray(pbValue);
+			};
+			Action<int> fI32 = delegate(int iValue)
+			{
+				MemUtil.Int32ToBytesEx(iValue, pb4, 0);
+				f(pb4, false);
+			};
+			Action<long> fI64 = delegate(long lValue)
+			{
+				MemUtil.Int64ToBytesEx(lValue, pb8, 0);
+				f(pb8, false);
+			};
+			Action<string> fStr = delegate(string strValue)
+			{
+				if(strValue == null) { Debug.Assert(false); return; }
+				if(strValue.Length == 0) return;
+				f(StrUtil.Utf8.GetBytes(strValue), false);
+			};
+
+			fI32(Environment.TickCount);
+			fI64(DateTime.UtcNow.ToBinary());
+
+#if !KeePassLibSD && !ModernKeePassLib
+			// In try-catch for systems without GUI;
+			// https://sourceforge.net/p/keepass/discussion/329221/thread/20335b73/
+			try
+			{
+				Point pt = Cursor.Position;
+				fI32(pt.X);
+				fI32(pt.Y);
+			}
+			catch(Exception) { Debug.Assert(NativeLib.IsUnix()); }
+#endif
+
+			try
+			{
+				fI32((int)NativeLib.GetPlatformID());
+#if KeePassUAP
+				fStr(EnvironmentExt.OSVersion.VersionString);
+#else
+				fStr(Environment.OSVersion.VersionString);
+#endif
+
+				fI32(Environment.ProcessorCount);
+
+#if !KeePassUAP
+				fStr(Environment.CommandLine);
+				fI64(Environment.WorkingSet);
+#endif
+			}
+			catch(Exception) { Debug.Assert(false); }
+
+			try
+			{
+				foreach(DictionaryEntry de in Environment.GetEnvironmentVariables())
+				{
+					fStr(de.Key as string);
+					fStr(de.Value as string);
+				}
+			}
+			catch(Exception) { Debug.Assert(false); }
+
+			try
+			{
+#if KeePassUAP
+				f(DiagnosticsExt.GetProcessEntropy(), true);
+#elif !KeePassLibSD
+				using(Process p = Process.GetCurrentProcess())
+				{
+					fI64(p.Handle.ToInt64());
+					fI32(p.HandleCount);
+					fI32(p.Id);
+					fI64(p.NonpagedSystemMemorySize64);
+					fI64(p.PagedMemorySize64);
+					fI64(p.PagedSystemMemorySize64);
+					fI64(p.PeakPagedMemorySize64);
+					fI64(p.PeakVirtualMemorySize64);
+					fI64(p.PeakWorkingSet64);
+					fI64(p.PrivateMemorySize64);
+					fI64(p.StartTime.ToBinary());
+					fI64(p.VirtualMemorySize64);
+					fI64(p.WorkingSet64);
+
+					// Not supported in Mono 1.2.6:
+					// fI32(p.SessionId);
+				}
+#endif
+			}
+			catch(Exception) { Debug.Assert(NativeLib.IsUnix()); }
+
+			try
+			{
+				CultureInfo ci = CultureInfo.CurrentCulture;
+				if(ci != null) fI32(ci.GetHashCode());
+				else { Debug.Assert(false); }
+			}
+			catch(Exception) { Debug.Assert(false); }
+
+			f(Guid.NewGuid().ToByteArray(), false);
+			f(GetCspRandom(), true);
+
+			h.TransformFinalBlock(MemUtil.EmptyByteArray, 0, 0);
+			byte[] pbHash = h.Hash;
+			h.Clear();
+			MemUtil.ZeroByteArray(pb4);
+			MemUtil.ZeroByteArray(pb8);
+			return pbHash;
+		}
+
+		private byte[] GetCspRandom()
+		{
+			byte[] pb = new byte[32];
+
+			try { m_rng.GetBytes(pb); }
+			catch(Exception)
+			{
+				Debug.Assert(false);
+				MemUtil.Int64ToBytesEx(DateTime.UtcNow.ToBinary(), pb, 0);
+			}
+
+			return pb;
+		}
+
+		private byte[] GenerateRandom256()
+		{
+			if(this.GenerateRandom256Pre != null)
+				this.GenerateRandom256Pre(this, EventArgs.Empty);
+
+			byte[] pbCmp;
+			lock(m_oSyncRoot)
+			{
+				m_uCounter += 0x74D8B29E4D38E161UL; // Prime number
+				byte[] pbCounter = MemUtil.UInt64ToBytes(m_uCounter);
+
+				byte[] pbCsp = GetCspRandom();
+
+				byte[] pbPool = m_pbEntropyPool.ReadData();
+				int cbPool = pbPool.Length;
+				int cbCtr = pbCounter.Length;
+				int cbCsp = pbCsp.Length;
+
+				pbCmp = new byte[cbPool + cbCtr + cbCsp];
+				Array.Copy(pbPool, pbCmp, cbPool);
+				Array.Copy(pbCounter, 0, pbCmp, cbPool, cbCtr);
+				Array.Copy(pbCsp, 0, pbCmp, cbPool + cbCtr, cbCsp);
+
+				MemUtil.ZeroByteArray(pbCsp);
+				MemUtil.ZeroByteArray(pbPool);
+
+				m_uGeneratedBytesCount += 32;
+			}
+
+			byte[] pbRet = CryptoUtil.HashSha256(pbCmp);
+			MemUtil.ZeroByteArray(pbCmp);
+			return pbRet;
+		}
+
+		/// <summary>
+		/// Get a number of cryptographically strong random bytes.
+		/// This method is thread-safe.
+		/// </summary>
+		/// <param name="uRequestedBytes">Number of requested random bytes.</param>
+		/// <returns>A byte array consisting of <paramref name="uRequestedBytes" />
+		/// random bytes.</returns>
+		public byte[] GetRandomBytes(uint uRequestedBytes)
+		{
+			if(uRequestedBytes == 0) return MemUtil.EmptyByteArray;
+			if(uRequestedBytes > (uint)int.MaxValue)
+			{
+				Debug.Assert(false);
+				throw new ArgumentOutOfRangeException("uRequestedBytes");
+			}
+
+			int cbRem = (int)uRequestedBytes;
+			byte[] pbRes = new byte[cbRem];
+			int iPos = 0;
+
+			while(cbRem != 0)
+			{
+				byte[] pbRandom256 = GenerateRandom256();
+				Debug.Assert(pbRandom256.Length == 32);
+
+				int cbCopy = Math.Min(cbRem, pbRandom256.Length);
+				Array.Copy(pbRandom256, 0, pbRes, iPos, cbCopy);
+
+				MemUtil.ZeroByteArray(pbRandom256);
+
+				iPos += cbCopy;
+				cbRem -= cbCopy;
+			}
+
+			Debug.Assert(iPos == pbRes.Length);
+			return pbRes;
+		}
+
+		private static int g_iWeakSeed = 0;
+		public static Random NewWeakRandom()
+		{
+			long s64 = DateTime.UtcNow.ToBinary();
+			int s32 = (int)((s64 >> 32) ^ s64);
+
+			lock(g_oSyncRoot)
+			{
+				unchecked
+				{
+					g_iWeakSeed += 0x78A8C4B7; // Prime number
+					s32 ^= g_iWeakSeed;
+				}
+			}
+
+			// Prevent overflow in the Random constructor of .NET 2.0
+			if(s32 == int.MinValue) s32 = int.MaxValue;
+
+			return new Random(s32);
+		}
+	}
+}

ModernKeePassLib/Cryptography/CryptoRandomStream.cs

@@ -0,0 +1,262 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Diagnostics;
+
+#if !KeePassUAP
+using System.Security.Cryptography;
+#endif
+
+using ModernKeePassLib.Cryptography.Cipher;
+using ModernKeePassLib.Utility;
+
+namespace ModernKeePassLib.Cryptography
+{
+	/// <summary>
+	/// Algorithms supported by <c>CryptoRandomStream</c>.
+	/// </summary>
+	public enum CrsAlgorithm
+	{
+		/// <summary>
+		/// Not supported.
+		/// </summary>
+		Null = 0,
+
+		/// <summary>
+		/// A variant of the ARCFour algorithm (RC4 incompatible).
+		/// Insecure; for backward compatibility only.
+		/// </summary>
+		ArcFourVariant = 1,
+
+		/// <summary>
+		/// Salsa20 stream cipher algorithm.
+		/// </summary>
+		Salsa20 = 2,
+
+		/// <summary>
+		/// ChaCha20 stream cipher algorithm.
+		/// </summary>
+		ChaCha20 = 3,
+
+		Count = 4
+	}
+
+	/// <summary>
+	/// A random stream class. The class is initialized using random
+	/// bytes provided by the caller. The produced stream has random
+	/// properties, but for the same seed always the same stream
+	/// is produced, i.e. this class can be used as stream cipher.
+	/// </summary>
+	public sealed class CryptoRandomStream : IDisposable
+	{
+		private readonly CrsAlgorithm m_crsAlgorithm;
+		private bool m_bDisposed = false;
+
+		private byte[] m_pbState = null;
+		private byte m_i = 0;
+		private byte m_j = 0;
+
+		private Salsa20Cipher m_salsa20 = null;
+		private ChaCha20Cipher m_chacha20 = null;
+
+		/// <summary>
+		/// Construct a new cryptographically secure random stream object.
+		/// </summary>
+		/// <param name="a">Algorithm to use.</param>
+		/// <param name="pbKey">Initialization key. Must not be <c>null</c>
+		/// and must contain at least 1 byte.</param>
+		public CryptoRandomStream(CrsAlgorithm a, byte[] pbKey)
+		{
+			if(pbKey == null) { Debug.Assert(false); throw new ArgumentNullException("pbKey"); }
+
+			int cbKey = pbKey.Length;
+			if(cbKey <= 0)
+			{
+				Debug.Assert(false); // Need at least one byte
+				throw new ArgumentOutOfRangeException("pbKey");
+			}
+
+			m_crsAlgorithm = a;
+
+			if(a == CrsAlgorithm.ChaCha20)
+			{
+				byte[] pbKey32 = new byte[32];
+				byte[] pbIV12 = new byte[12];
+
+				using(SHA512Managed h = new SHA512Managed())
+				{
+					byte[] pbHash = h.ComputeHash(pbKey);
+					Array.Copy(pbHash, pbKey32, 32);
+					Array.Copy(pbHash, 32, pbIV12, 0, 12);
+					MemUtil.ZeroByteArray(pbHash);
+				}
+
+				m_chacha20 = new ChaCha20Cipher(pbKey32, pbIV12, true);
+			}
+			else if(a == CrsAlgorithm.Salsa20)
+			{
+				byte[] pbKey32 = CryptoUtil.HashSha256(pbKey);
+				byte[] pbIV8 = new byte[8] { 0xE8, 0x30, 0x09, 0x4B,
+					0x97, 0x20, 0x5D, 0x2A }; // Unique constant
+
+				m_salsa20 = new Salsa20Cipher(pbKey32, pbIV8);
+			}
+			else if(a == CrsAlgorithm.ArcFourVariant)
+			{
+				// Fill the state linearly
+				m_pbState = new byte[256];
+				for(int w = 0; w < 256; ++w) m_pbState[w] = (byte)w;
+
+				unchecked
+				{
+					byte j = 0, t;
+					int inxKey = 0;
+					for(int w = 0; w < 256; ++w) // Key setup
+					{
+						j += (byte)(m_pbState[w] + pbKey[inxKey]);
+
+						t = m_pbState[0]; // Swap entries
+						m_pbState[0] = m_pbState[j];
+						m_pbState[j] = t;
+
+						++inxKey;
+						if(inxKey >= cbKey) inxKey = 0;
+					}
+				}
+
+				GetRandomBytes(512); // Increases security, see cryptanalysis
+			}
+			else // Unknown algorithm
+			{
+				Debug.Assert(false);
+				throw new ArgumentOutOfRangeException("a");
+			}
+		}
+
+		public void Dispose()
+		{
+			Dispose(true);
+			GC.SuppressFinalize(this);
+		}
+
+		private void Dispose(bool disposing)
+		{
+			if(disposing)
+			{
+				if(m_crsAlgorithm == CrsAlgorithm.ChaCha20)
+					m_chacha20.Dispose();
+				else if(m_crsAlgorithm == CrsAlgorithm.Salsa20)
+					m_salsa20.Dispose();
+				else if(m_crsAlgorithm == CrsAlgorithm.ArcFourVariant)
+				{
+					MemUtil.ZeroByteArray(m_pbState);
+					m_i = 0;
+					m_j = 0;
+				}
+				else { Debug.Assert(false); }
+
+				m_bDisposed = true;
+			}
+		}
+
+		/// <summary>
+		/// Get <paramref name="uRequestedCount" /> random bytes.
+		/// </summary>
+		/// <param name="uRequestedCount">Number of random bytes to retrieve.</param>
+		/// <returns>Returns <paramref name="uRequestedCount" /> random bytes.</returns>
+		public byte[] GetRandomBytes(uint uRequestedCount)
+		{
+			if(m_bDisposed) throw new ObjectDisposedException(null);
+
+			if(uRequestedCount == 0) return MemUtil.EmptyByteArray;
+			if(uRequestedCount > (uint)int.MaxValue)
+				throw new ArgumentOutOfRangeException("uRequestedCount");
+			int cb = (int)uRequestedCount;
+
+			byte[] pbRet = new byte[cb];
+
+			if(m_crsAlgorithm == CrsAlgorithm.ChaCha20)
+				m_chacha20.Encrypt(pbRet, 0, cb);
+			else if(m_crsAlgorithm == CrsAlgorithm.Salsa20)
+				m_salsa20.Encrypt(pbRet, 0, cb);
+			else if(m_crsAlgorithm == CrsAlgorithm.ArcFourVariant)
+			{
+				unchecked
+				{
+					for(int w = 0; w < cb; ++w)
+					{
+						++m_i;
+						m_j += m_pbState[m_i];
+
+						byte t = m_pbState[m_i]; // Swap entries
+						m_pbState[m_i] = m_pbState[m_j];
+						m_pbState[m_j] = t;
+
+						t = (byte)(m_pbState[m_i] + m_pbState[m_j]);
+						pbRet[w] = m_pbState[t];
+					}
+				}
+			}
+			else { Debug.Assert(false); }
+
+			return pbRet;
+		}
+
+		public ulong GetRandomUInt64()
+		{
+			byte[] pb = GetRandomBytes(8);
+			return MemUtil.BytesToUInt64(pb);
+		}
+
+#if CRSBENCHMARK
+		public static string Benchmark()
+		{
+			int nRounds = 2000000;
+			
+			string str = "ArcFour small: " + BenchTime(CrsAlgorithm.ArcFourVariant,
+				nRounds, 16).ToString() + "\r\n";
+			str += "ArcFour big: " + BenchTime(CrsAlgorithm.ArcFourVariant,
+				32, 2 * 1024 * 1024).ToString() + "\r\n";
+			str += "Salsa20 small: " + BenchTime(CrsAlgorithm.Salsa20,
+				nRounds, 16).ToString() + "\r\n";
+			str += "Salsa20 big: " + BenchTime(CrsAlgorithm.Salsa20,
+				32, 2 * 1024 * 1024).ToString();
+			return str;
+		}
+
+		private static int BenchTime(CrsAlgorithm cra, int nRounds, int nDataSize)
+		{
+			byte[] pbKey = new byte[4] { 0x00, 0x01, 0x02, 0x03 };
+
+			int nStart = Environment.TickCount;
+			for(int i = 0; i < nRounds; ++i)
+			{
+				using(CryptoRandomStream c = new CryptoRandomStream(cra, pbKey))
+				{
+					c.GetRandomBytes((uint)nDataSize);
+				}
+			}
+			int nEnd = Environment.TickCount;
+
+			return (nEnd - nStart);
+		}
+#endif
+	}
+}

ModernKeePassLib/Cryptography/CryptoStreamEx.cs

@@ -0,0 +1,64 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Text;
+
+#if !KeePassUAP
+using System.Security.Cryptography;
+
+namespace ModernKeePassLib.Cryptography
+{
+    public sealed class CryptoStreamEx : CryptoStream
+    {
+        private ICryptoTransform m_t;
+        private SymmetricAlgorithm m_a;
+
+        public CryptoStreamEx(Stream s, ICryptoTransform t, CryptoStreamMode m,
+            SymmetricAlgorithm a) : base(s, t, m)
+        {
+            m_t = t;
+            m_a = a;
+        }
+
+        protected override void Dispose(bool disposing)
+        {
+            try { base.Dispose(disposing); }
+            // Unnecessary exception from CryptoStream with
+            // RijndaelManagedTransform when a stream hasn't been
+            // read completely (e.g. incorrect master key)
+            catch (CryptographicException) { }
+            catch (Exception) { Debug.Assert(false); }
+
+            if (disposing)
+            {
+                try { if (m_t != null) { m_t.Dispose(); m_t = null; } }
+                catch (Exception) { Debug.Assert(false); }
+
+                // In .NET 2.0, SymmetricAlgorithm.Dispose() is not public
+                try { if (m_a != null) { m_a.Clear(); m_a = null; } }
+                catch (Exception) { Debug.Assert(false); }
+            }
+        }
+    }
+}
+#endif

ModernKeePassLib/Cryptography/CryptoUtil.cs

@@ -0,0 +1,254 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Reflection;
+using System.Text;
+
+#if !KeePassUAP
+using System.Security.Cryptography;
+#endif
+
+using ModernKeePassLib.Native;
+using ModernKeePassLib.Utility;
+
+namespace ModernKeePassLib.Cryptography
+{
+	public static class CryptoUtil
+	{
+		private static bool? g_obProtData = null;
+		public static bool IsProtectedDataSupported
+		{
+			get
+			{
+				if(g_obProtData.HasValue) return g_obProtData.Value;
+
+				bool b = false;
+				try
+				{
+					Random r = CryptoRandom.NewWeakRandom();
+
+					byte[] pbData = new byte[137];
+					r.NextBytes(pbData);
+
+					byte[] pbEnt = new byte[41];
+					r.NextBytes(pbEnt);
+
+					byte[] pbEnc = ProtectedData.Protect(pbData, pbEnt,
+						DataProtectionScope.CurrentUser);
+					if((pbEnc != null) && !MemUtil.ArraysEqual(pbEnc, pbData))
+					{
+						byte[] pbDec = ProtectedData.Unprotect(pbEnc, pbEnt,
+							DataProtectionScope.CurrentUser);
+						if((pbDec != null) && MemUtil.ArraysEqual(pbDec, pbData))
+							b = true;
+					}
+				}
+				catch(Exception) { Debug.Assert(false); }
+
+				Debug.Assert(b); // Should be supported on all systems
+				g_obProtData = b;
+				return b;
+			}
+		}
+
+		public static byte[] HashSha256(byte[] pbData)
+		{
+			if(pbData == null) throw new ArgumentNullException("pbData");
+
+			return HashSha256(pbData, 0, pbData.Length);
+		}
+
+		public static byte[] HashSha256(byte[] pbData, int iOffset, int cbCount)
+		{
+			if(pbData == null) throw new ArgumentNullException("pbData");
+
+#if DEBUG
+			byte[] pbCopy = new byte[pbData.Length];
+			Array.Copy(pbData, pbCopy, pbData.Length);
+#endif
+
+			byte[] pbHash;
+			using(SHA256Managed h = new SHA256Managed())
+			{
+				pbHash = h.ComputeHash(pbData, iOffset, cbCount);
+			}
+
+#if DEBUG
+			// Ensure the data has not been modified
+			Debug.Assert(MemUtil.ArraysEqual(pbData, pbCopy));
+
+			Debug.Assert((pbHash != null) && (pbHash.Length == 32));
+			byte[] pbZero = new byte[32];
+			Debug.Assert(!MemUtil.ArraysEqual(pbHash, pbZero));
+#endif
+
+			return pbHash;
+		}
+
+		internal static byte[] HashSha256(string strFilePath)
+		{
+			byte[] pbHash = null;
+
+			using(FileStream fs = new FileStream(strFilePath, FileMode.Open,
+				FileAccess.Read, FileShare.Read))
+			{
+				using(SHA256Managed h = new SHA256Managed())
+				{
+					pbHash = h.ComputeHash(fs);
+				}
+			}
+
+			return pbHash;
+		}
+
+		/// <summary>
+		/// Create a cryptographic key of length <paramref name="cbOut" />
+		/// (in bytes) from <paramref name="pbIn" />.
+		/// </summary>
+		public static byte[] ResizeKey(byte[] pbIn, int iInOffset,
+			int cbIn, int cbOut)
+		{
+			if(pbIn == null) throw new ArgumentNullException("pbIn");
+			if(cbOut < 0) throw new ArgumentOutOfRangeException("cbOut");
+
+			if(cbOut == 0) return MemUtil.EmptyByteArray;
+
+			byte[] pbHash;
+			if(cbOut <= 32) pbHash = HashSha256(pbIn, iInOffset, cbIn);
+			else
+			{
+				using(SHA512Managed h = new SHA512Managed())
+				{
+					pbHash = h.ComputeHash(pbIn, iInOffset, cbIn);
+				}
+			}
+
+			if(cbOut == pbHash.Length) return pbHash;
+
+			byte[] pbRet = new byte[cbOut];
+			if(cbOut < pbHash.Length)
+				Array.Copy(pbHash, pbRet, cbOut);
+			else
+			{
+				int iPos = 0;
+				ulong r = 0;
+				while(iPos < cbOut)
+				{
+					Debug.Assert(pbHash.Length == 64);
+					using(HMACSHA256 h = new HMACSHA256(pbHash))
+					{
+						byte[] pbR = MemUtil.UInt64ToBytes(r);
+						byte[] pbPart = h.ComputeHash(pbR);
+
+						int cbCopy = Math.Min(cbOut - iPos, pbPart.Length);
+						Debug.Assert(cbCopy > 0);
+
+						Array.Copy(pbPart, 0, pbRet, iPos, cbCopy);
+						iPos += cbCopy;
+						++r;
+
+						MemUtil.ZeroByteArray(pbPart);
+					}
+				}
+				Debug.Assert(iPos == cbOut);
+			}
+
+#if DEBUG
+			byte[] pbZero = new byte[pbHash.Length];
+			Debug.Assert(!MemUtil.ArraysEqual(pbHash, pbZero));
+#endif
+			MemUtil.ZeroByteArray(pbHash);
+			return pbRet;
+		}
+
+#if !KeePassUAP
+		private static bool? g_obAesCsp = null;
+		public static SymmetricAlgorithm CreateAes()
+		{
+			if(g_obAesCsp.HasValue)
+				return (g_obAesCsp.Value ? CreateAesCsp() : new RijndaelManaged());
+
+			SymmetricAlgorithm a = CreateAesCsp();
+			g_obAesCsp = (a != null);
+			return (a ?? new RijndaelManaged());
+		}
+
+		private static SymmetricAlgorithm CreateAesCsp()
+		{
+			try
+			{
+				// On Windows, the CSP implementation is only minimally
+				// faster (and for key derivations it's not used anyway,
+				// as KeePass uses a native implementation based on
+				// CNG/BCrypt, which is much faster)
+				if(!NativeLib.IsUnix()) return null;
+
+				string strFqn = Assembly.CreateQualifiedName(
+					"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",
+					"System.Security.Cryptography.AesCryptoServiceProvider");
+
+				Type t = Type.GetType(strFqn);
+				if(t == null) return null;
+
+				return (Activator.CreateInstance(t) as SymmetricAlgorithm);
+			}
+			catch(Exception) { Debug.Assert(false); }
+
+			return null;
+		}
+#endif
+
+		public static byte[] ProtectData(byte[] pb, byte[] pbOptEntropy,
+			DataProtectionScope s)
+		{
+			return ProtectDataPriv(pb, true, pbOptEntropy, s);
+		}
+
+		public static byte[] UnprotectData(byte[] pb, byte[] pbOptEntropy,
+			DataProtectionScope s)
+		{
+			return ProtectDataPriv(pb, false, pbOptEntropy, s);
+		}
+
+		private static byte[] ProtectDataPriv(byte[] pb, bool bProtect,
+			byte[] pbOptEntropy, DataProtectionScope s)
+		{
+			if(pb == null) throw new ArgumentNullException("pb");
+
+			if((pbOptEntropy != null) && (pbOptEntropy.Length == 0))
+				pbOptEntropy = null;
+
+			if(CryptoUtil.IsProtectedDataSupported)
+			{
+				if(bProtect)
+					return ProtectedData.Protect(pb, pbOptEntropy, s);
+				return ProtectedData.Unprotect(pb, pbOptEntropy, s);
+			}
+
+			Debug.Assert(false);
+			byte[] pbCopy = new byte[pb.Length];
+			Array.Copy(pb, pbCopy, pb.Length);
+			return pbCopy;
+		}
+	}
+}

ModernKeePassLib/Cryptography/Hash/Blake2b.cs

@@ -0,0 +1,232 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+// This implementation is based on the official reference C
+// implementation by Samuel Neves (CC0 1.0 Universal).
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Text;
+
+#if !KeePassUAP
+using System.Security.Cryptography;
+#endif
+
+using ModernKeePassLib.Utility;
+
+namespace ModernKeePassLib.Cryptography.Hash
+{
+	public sealed class Blake2b : HashAlgorithm
+	{
+		private const int NbRounds = 12;
+		private const int NbBlockBytes = 128;
+		private const int NbMaxOutBytes = 64;
+
+		private static readonly ulong[] g_vIV = new ulong[8] {
+			0x6A09E667F3BCC908UL, 0xBB67AE8584CAA73BUL,
+			0x3C6EF372FE94F82BUL, 0xA54FF53A5F1D36F1UL,
+			0x510E527FADE682D1UL, 0x9B05688C2B3E6C1FUL,
+			0x1F83D9ABFB41BD6BUL, 0x5BE0CD19137E2179UL
+		};
+
+		private static readonly int[] g_vSigma = new int[NbRounds * 16] {
+			0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+			14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3,
+			11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4,
+			7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8,
+			9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13,
+			2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9,
+			12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11,
+			13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10,
+			6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5,
+			10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0,
+			0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+			14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3
+		};
+
+		private readonly int m_cbHashLength;
+
+		private ulong[] m_h = new ulong[8];
+		private ulong[] m_t = new ulong[2];
+		private ulong[] m_f = new ulong[2];
+		private byte[] m_buf = new byte[NbBlockBytes];
+		private int m_cbBuf = 0;
+
+		private ulong[] m_m = new ulong[16];
+		private ulong[] m_v = new ulong[16];
+
+		public Blake2b()
+		{
+			m_cbHashLength = NbMaxOutBytes;
+			this.HashSizeValue = NbMaxOutBytes * 8; // Bits
+
+			Initialize();
+		}
+
+		public Blake2b(int cbHashLength)
+		{
+			if((cbHashLength < 0) || (cbHashLength > NbMaxOutBytes))
+				throw new ArgumentOutOfRangeException("cbHashLength");
+
+			m_cbHashLength = cbHashLength;
+			this.HashSizeValue = cbHashLength * 8; // Bits
+
+			Initialize();
+		}
+
+		public override void Initialize()
+		{
+			Debug.Assert(m_h.Length == g_vIV.Length);
+			Array.Copy(g_vIV, m_h, m_h.Length);
+
+			// Fan-out = 1, depth = 1
+			m_h[0] ^= 0x0000000001010000UL ^ (ulong)m_cbHashLength;
+
+			Array.Clear(m_t, 0, m_t.Length);
+			Array.Clear(m_f, 0, m_f.Length);
+			Array.Clear(m_buf, 0, m_buf.Length);
+			m_cbBuf = 0;
+
+			Array.Clear(m_m, 0, m_m.Length);
+			Array.Clear(m_v, 0, m_v.Length);
+		}
+
+		private static void G(ulong[] v, ulong[] m, int r16, int i,
+			int a, int b, int c, int d)
+		{
+			int p = r16 + i;
+
+			v[a] += v[b] + m[g_vSigma[p]];
+			v[d] = MemUtil.RotateRight64(v[d] ^ v[a], 32);
+			v[c] += v[d];
+			v[b] = MemUtil.RotateRight64(v[b] ^ v[c], 24);
+			v[a] += v[b] + m[g_vSigma[p + 1]];
+			v[d] = MemUtil.RotateRight64(v[d] ^ v[a], 16);
+			v[c] += v[d];
+			v[b] = MemUtil.RotateRight64(v[b] ^ v[c], 63);
+		}
+
+		private void Compress(byte[] pb, int iOffset)
+		{
+			ulong[] v = m_v;
+			ulong[] m = m_m;
+			ulong[] h = m_h;
+
+			for(int i = 0; i < 16; ++i)
+				m[i] = MemUtil.BytesToUInt64(pb, iOffset + (i << 3));
+
+			Array.Copy(h, v, 8);
+			v[8] = g_vIV[0];
+			v[9] = g_vIV[1];
+			v[10] = g_vIV[2];
+			v[11] = g_vIV[3];
+			v[12] = g_vIV[4] ^ m_t[0];
+			v[13] = g_vIV[5] ^ m_t[1];
+			v[14] = g_vIV[6] ^ m_f[0];
+			v[15] = g_vIV[7] ^ m_f[1];
+
+			for(int r = 0; r < NbRounds; ++r)
+			{
+				int r16 = r << 4;
+
+				G(v, m, r16, 0, 0, 4, 8, 12);
+				G(v, m, r16, 2, 1, 5, 9, 13);
+				G(v, m, r16, 4, 2, 6, 10, 14);
+				G(v, m, r16, 6, 3, 7, 11, 15);
+				G(v, m, r16, 8, 0, 5, 10, 15);
+				G(v, m, r16, 10, 1, 6, 11, 12);
+				G(v, m, r16, 12, 2, 7, 8, 13);
+				G(v, m, r16, 14, 3, 4, 9, 14);
+			}
+
+			for(int i = 0; i < 8; ++i)
+				h[i] ^= v[i] ^ v[i + 8];
+		}
+
+		private void IncrementCounter(ulong cb)
+		{
+			m_t[0] += cb;
+			if(m_t[0] < cb) ++m_t[1];
+		}
+
+		protected override void HashCore(byte[] array, int ibStart, int cbSize)
+		{
+			Debug.Assert(m_f[0] == 0);
+
+			if((m_cbBuf + cbSize) > NbBlockBytes) // Not '>=' (buffer must not be empty)
+			{
+				int cbFill = NbBlockBytes - m_cbBuf;
+				if(cbFill > 0) Array.Copy(array, ibStart, m_buf, m_cbBuf, cbFill);
+
+				IncrementCounter((ulong)NbBlockBytes);
+				Compress(m_buf, 0);
+
+				m_cbBuf = 0;
+				cbSize -= cbFill;
+				ibStart += cbFill;
+
+				while(cbSize > NbBlockBytes) // Not '>=' (buffer must not be empty)
+				{
+					IncrementCounter((ulong)NbBlockBytes);
+					Compress(array, ibStart);
+
+					cbSize -= NbBlockBytes;
+					ibStart += NbBlockBytes;
+				}
+			}
+
+			if(cbSize > 0)
+			{
+				Debug.Assert((m_cbBuf + cbSize) <= NbBlockBytes);
+
+				Array.Copy(array, ibStart, m_buf, m_cbBuf, cbSize);
+				m_cbBuf += cbSize;
+			}
+		}
+
+		protected override byte[] HashFinal()
+		{
+			if(m_f[0] != 0) { Debug.Assert(false); throw new InvalidOperationException(); }
+			Debug.Assert(((m_t[1] == 0) && (m_t[0] == 0)) ||
+				(m_cbBuf > 0)); // Buffer must not be empty for last block processing
+
+			m_f[0] = ulong.MaxValue; // Indicate last block
+
+			int cbFill = NbBlockBytes - m_cbBuf;
+			if(cbFill > 0) Array.Clear(m_buf, m_cbBuf, cbFill);
+
+			IncrementCounter((ulong)m_cbBuf);
+			Compress(m_buf, 0);
+
+			byte[] pbHash = new byte[NbMaxOutBytes];
+			for(int i = 0; i < m_h.Length; ++i)
+				MemUtil.UInt64ToBytesEx(m_h[i], pbHash, i << 3);
+
+			if(m_cbHashLength == NbMaxOutBytes) return pbHash;
+			Debug.Assert(m_cbHashLength < NbMaxOutBytes);
+
+			byte[] pbShort = new byte[m_cbHashLength];
+			if(m_cbHashLength > 0)
+				Array.Copy(pbHash, pbShort, m_cbHashLength);
+			MemUtil.ZeroByteArray(pbHash);
+			return pbShort;
+		}
+	}
+}

ModernKeePassLib/Cryptography/HashingStreamEx.cs

@@ -0,0 +1,187 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Text;
+
+#if !KeePassUAP
+using System.Security.Cryptography;
+#endif
+
+using ModernKeePassLib.Utility;
+
+namespace ModernKeePassLib.Cryptography
+{
+	public sealed class HashingStreamEx : Stream
+	{
+		private readonly Stream m_sBaseStream;
+		private readonly bool m_bWriting;
+		private HashAlgorithm m_hash;
+
+		private byte[] m_pbFinalHash = null;
+
+		public byte[] Hash
+		{
+			get { return m_pbFinalHash; }
+		}
+
+		public override bool CanRead
+		{
+			get { return !m_bWriting; }
+		}
+
+		public override bool CanSeek
+		{
+			get { return false; }
+		}
+
+		public override bool CanWrite
+		{
+			get { return m_bWriting; }
+		}
+
+		public override long Length
+		{
+			get { return m_sBaseStream.Length; }
+		}
+
+		public override long Position
+		{
+			get { return m_sBaseStream.Position; }
+			set { Debug.Assert(false); throw new NotSupportedException(); }
+		}
+
+		public HashingStreamEx(Stream sBaseStream, bool bWriting, HashAlgorithm hashAlgorithm)
+		{
+			if(sBaseStream == null) throw new ArgumentNullException("sBaseStream");
+
+			m_sBaseStream = sBaseStream;
+			m_bWriting = bWriting;
+
+#if !KeePassLibSD
+			m_hash = (hashAlgorithm ?? new SHA256Managed());
+#else // KeePassLibSD
+			m_hash = null;
+
+			try { m_hash = HashAlgorithm.Create("SHA256"); }
+			catch(Exception) { }
+			try { if(m_hash == null) m_hash = HashAlgorithm.Create(); }
+			catch(Exception) { }
+#endif
+			if(m_hash == null) { Debug.Assert(false); return; }
+
+			// Validate hash algorithm
+			if(!m_hash.CanReuseTransform || !m_hash.CanTransformMultipleBlocks)
+			{
+				Debug.Assert(false);
+				m_hash = null;
+			}
+		}
+
+		protected override void Dispose(bool disposing)
+		{
+			if(disposing)
+			{
+				if(m_hash != null)
+				{
+					try
+					{
+						m_hash.TransformFinalBlock(MemUtil.EmptyByteArray, 0, 0);
+						m_pbFinalHash = m_hash.Hash;
+						m_hash.Clear();
+					}
+					catch(Exception) { Debug.Assert(false); }
+
+					m_hash = null;
+				}
+
+				m_sBaseStream.Dispose();
+			}
+
+			base.Dispose(disposing);
+		}
+
+		public override void Flush()
+		{
+			m_sBaseStream.Flush();
+		}
+
+		public override long Seek(long lOffset, SeekOrigin soOrigin)
+		{
+			Debug.Assert(false);
+			throw new NotSupportedException();
+		}
+
+		public override void SetLength(long lValue)
+		{
+			Debug.Assert(false);
+			throw new NotSupportedException();
+		}
+
+		public override int Read(byte[] pbBuffer, int nOffset, int nCount)
+		{
+			if(m_bWriting) { Debug.Assert(false); throw new InvalidOperationException(); }
+
+			int nRead = m_sBaseStream.Read(pbBuffer, nOffset, nCount);
+			int nPartialRead = nRead;
+			while((nRead < nCount) && (nPartialRead != 0))
+			{
+				nPartialRead = m_sBaseStream.Read(pbBuffer, nOffset + nRead,
+					nCount - nRead);
+				nRead += nPartialRead;
+			}
+
+#if DEBUG
+			byte[] pbOrg = new byte[pbBuffer.Length];
+			Array.Copy(pbBuffer, pbOrg, pbBuffer.Length);
+#endif
+
+			if((m_hash != null) && (nRead > 0))
+				m_hash.TransformBlock(pbBuffer, nOffset, nRead, pbBuffer, nOffset);
+
+#if DEBUG
+			Debug.Assert(MemUtil.ArraysEqual(pbBuffer, pbOrg));
+#endif
+
+			return nRead;
+		}
+
+		public override void Write(byte[] pbBuffer, int nOffset, int nCount)
+		{
+			if(!m_bWriting) { Debug.Assert(false); throw new InvalidOperationException(); }
+
+#if DEBUG
+			byte[] pbOrg = new byte[pbBuffer.Length];
+			Array.Copy(pbBuffer, pbOrg, pbBuffer.Length);
+#endif
+
+			if((m_hash != null) && (nCount > 0))
+				m_hash.TransformBlock(pbBuffer, nOffset, nCount, pbBuffer, nOffset);
+
+#if DEBUG
+			Debug.Assert(MemUtil.ArraysEqual(pbBuffer, pbOrg));
+#endif
+
+			m_sBaseStream.Write(pbBuffer, nOffset, nCount);
+		}
+	}
+}

ModernKeePassLib/Cryptography/HmacOtp.cs

@@ -0,0 +1,98 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Text;
+
+#if !KeePassUAP
+using System.Security.Cryptography;
+#endif
+
+using ModernKeePassLib.Utility;
+
+#if !KeePassLibSD
+namespace ModernKeePassLib.Cryptography
+{
+	/// <summary>
+	/// Generate HMAC-based one-time passwords as specified in RFC 4226.
+	/// </summary>
+	public static class HmacOtp
+	{
+		private static readonly uint[] g_vDigitsPower = new uint[] { 1,
+			10, 100, 1000, 10000, 100000, 1000000, 10000000, 100000000 };
+
+		public static string Generate(byte[] pbSecret, ulong uFactor,
+			uint uCodeDigits, bool bAddChecksum, int iTruncationOffset)
+		{
+			byte[] pbText = MemUtil.UInt64ToBytes(uFactor);
+			Array.Reverse(pbText); // To big-endian
+
+			byte[] pbHash;
+			using(HMACSHA1 h = new HMACSHA1(pbSecret))
+			{
+				pbHash = h.ComputeHash(pbText);
+			}
+
+			uint uOffset = (uint)(pbHash[pbHash.Length - 1] & 0xF);
+			if((iTruncationOffset >= 0) && (iTruncationOffset < (pbHash.Length - 4)))
+				uOffset = (uint)iTruncationOffset;
+
+			uint uBinary = (uint)(((pbHash[uOffset] & 0x7F) << 24) |
+				((pbHash[uOffset + 1] & 0xFF) << 16) |
+				((pbHash[uOffset + 2] & 0xFF) << 8) |
+				(pbHash[uOffset + 3] & 0xFF));
+
+			uint uOtp = (uBinary % g_vDigitsPower[uCodeDigits]);
+			if(bAddChecksum)
+				uOtp = ((uOtp * 10) + CalculateChecksum(uOtp, uCodeDigits));
+
+			uint uDigits = (bAddChecksum ? (uCodeDigits + 1) : uCodeDigits);
+			return uOtp.ToString(NumberFormatInfo.InvariantInfo).PadLeft(
+				(int)uDigits, '0');
+		}
+
+		private static readonly uint[] g_vDoubleDigits = new uint[] {
+			0, 2, 4, 6, 8, 1, 3, 5, 7, 9 };
+
+		private static uint CalculateChecksum(uint uNum, uint uDigits)
+		{
+			bool bDoubleDigit = true;
+			uint uTotal = 0;
+
+			while(0 < uDigits--)
+			{
+				uint uDigit = (uNum % 10);
+				uNum /= 10;
+
+				if(bDoubleDigit) uDigit = g_vDoubleDigits[uDigit];
+
+				uTotal += uDigit;
+				bDoubleDigit = !bDoubleDigit;
+			}
+
+			uint uResult = (uTotal % 10);
+			if(uResult != 0) uResult = 10 - uResult;
+
+			return uResult;
+		}
+	}
+}
+#endif

ModernKeePassLib/Cryptography/KeyDerivation/AesKdf.GCrypt.cs

@@ -0,0 +1,399 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Threading;
+
+using ModernKeePassLib.Native;
+using ModernKeePassLib.Utility;
+
+namespace ModernKeePassLib.Cryptography.KeyDerivation
+{
+	public sealed partial class AesKdf : KdfEngine
+	{
+		private static bool TransformKeyGCrypt(byte[] pbData32, byte[] pbSeed32,
+			ulong uRounds)
+		{
+			byte[] pbNewData32 = null;
+			try
+			{
+				if(GCryptInitLib())
+				{
+					pbNewData32 = new byte[32];
+					Array.Copy(pbData32, pbNewData32, 32);
+
+					if(TransformKeyGCryptPriv(pbNewData32, pbSeed32, uRounds))
+					{
+						Array.Copy(pbNewData32, pbData32, 32);
+						return true;
+					}
+				}
+			}
+			catch(Exception) { }
+			finally { if(pbNewData32 != null) MemUtil.ZeroByteArray(pbNewData32); }
+
+			return false;
+		}
+
+		private static bool TransformKeyBenchmarkGCrypt(uint uTimeMs, out ulong uRounds)
+		{
+			uRounds = 0;
+
+			try
+			{
+				if(GCryptInitLib())
+					return TransformKeyBenchmarkGCryptPriv(uTimeMs, ref uRounds);
+			}
+			catch(Exception) { }
+
+			return false;
+		}
+
+		private static bool GCryptInitLib()
+		{
+			if(!NativeLib.IsUnix()) return false; // Independent of workaround state
+			if(!MonoWorkarounds.IsRequired(1468)) return false; // Can be turned off
+
+			// gcry_check_version initializes the library;
+			// throws when LibGCrypt is not available
+			NativeMethods.gcry_check_version(IntPtr.Zero);
+			return true;
+		}
+
+		// =============================================================
+		// Multi-threaded implementation
+
+		// For some reason, the following multi-threaded implementation
+		// is slower than the single-threaded implementation below
+		// (threading overhead by Mono? LibGCrypt threading issues?)
+		/* private sealed class GCryptTransformInfo : IDisposable
+		{
+			public IntPtr Data16;
+			public IntPtr Seed32;
+			public ulong Rounds;
+			public uint TimeMs;
+
+			public bool Success = false;
+
+			public GCryptTransformInfo(byte[] pbData32, int iDataOffset,
+				byte[] pbSeed32, ulong uRounds, uint uTimeMs)
+			{
+				this.Data16 = Marshal.AllocCoTaskMem(16);
+				Marshal.Copy(pbData32, iDataOffset, this.Data16, 16);
+
+				this.Seed32 = Marshal.AllocCoTaskMem(32);
+				Marshal.Copy(pbSeed32, 0, this.Seed32, 32);
+
+				this.Rounds = uRounds;
+				this.TimeMs = uTimeMs;
+			}
+
+			public void Dispose()
+			{
+				if(this.Data16 != IntPtr.Zero)
+				{
+					Marshal.WriteInt64(this.Data16, 0);
+					Marshal.WriteInt64(this.Data16, 8, 0);
+					Marshal.FreeCoTaskMem(this.Data16);
+					this.Data16 = IntPtr.Zero;
+				}
+
+				if(this.Seed32 != IntPtr.Zero)
+				{
+					Marshal.FreeCoTaskMem(this.Seed32);
+					this.Seed32 = IntPtr.Zero;
+				}
+			}
+		}
+
+		private static GCryptTransformInfo[] GCryptRun(byte[] pbData32,
+			byte[] pbSeed32, ulong uRounds, uint uTimeMs, ParameterizedThreadStart fL,
+			ParameterizedThreadStart fR)
+		{
+			GCryptTransformInfo tiL = new GCryptTransformInfo(pbData32, 0,
+				pbSeed32, uRounds, uTimeMs);
+			GCryptTransformInfo tiR = new GCryptTransformInfo(pbData32, 16,
+				pbSeed32, uRounds, uTimeMs);
+
+			Thread th = new Thread(fL);
+			th.Start(tiL);
+
+			fR(tiR);
+
+			th.Join();
+
+			Marshal.Copy(tiL.Data16, pbData32, 0, 16);
+			Marshal.Copy(tiR.Data16, pbData32, 16, 16);
+
+			tiL.Dispose();
+			tiR.Dispose();
+
+			if(tiL.Success && tiR.Success)
+				return new GCryptTransformInfo[2] { tiL, tiR };
+			return null;
+		}
+
+		private static bool TransformKeyGCryptPriv(byte[] pbData32, byte[] pbSeed32,
+			ulong uRounds)
+		{
+			return (GCryptRun(pbData32, pbSeed32, uRounds, 0,
+				new ParameterizedThreadStart(AesKdf.GCryptTransformTh),
+				new ParameterizedThreadStart(AesKdf.GCryptTransformTh)) != null);
+		}
+
+		private static bool GCryptInitCipher(ref IntPtr h, GCryptTransformInfo ti)
+		{
+			NativeMethods.gcry_cipher_open(ref h, NativeMethods.GCRY_CIPHER_AES256,
+				NativeMethods.GCRY_CIPHER_MODE_ECB, 0);
+			if(h == IntPtr.Zero) { Debug.Assert(false); return false; }
+
+			IntPtr n32 = new IntPtr(32);
+			if(NativeMethods.gcry_cipher_setkey(h, ti.Seed32, n32) != 0)
+			{
+				Debug.Assert(false);
+				return false;
+			}
+
+			return true;
+		}
+
+		private static void GCryptTransformTh(object o)
+		{
+			IntPtr h = IntPtr.Zero;
+			try
+			{
+				GCryptTransformInfo ti = (o as GCryptTransformInfo);
+				if(ti == null) { Debug.Assert(false); return; }
+
+				if(!GCryptInitCipher(ref h, ti)) return;
+
+				IntPtr n16 = new IntPtr(16);
+				for(ulong u = 0; u < ti.Rounds; ++u)
+				{
+					if(NativeMethods.gcry_cipher_encrypt(h, ti.Data16, n16,
+						IntPtr.Zero, IntPtr.Zero) != 0)
+					{
+						Debug.Assert(false);
+						return;
+					}
+				}
+
+				ti.Success = true;
+			}
+			catch(Exception) { Debug.Assert(false); }
+			finally
+			{
+				try { if(h != IntPtr.Zero) NativeMethods.gcry_cipher_close(h); }
+				catch(Exception) { Debug.Assert(false); }
+			}
+		}
+
+		private static bool TransformKeyBenchmarkGCryptPriv(uint uTimeMs, ref ulong uRounds)
+		{
+			GCryptTransformInfo[] v = GCryptRun(new byte[32], new byte[32],
+				0, uTimeMs,
+				new ParameterizedThreadStart(AesKdf.GCryptBenchmarkTh),
+				new ParameterizedThreadStart(AesKdf.GCryptBenchmarkTh));
+
+			if(v != null)
+			{
+				ulong uL = Math.Min(v[0].Rounds, ulong.MaxValue >> 1);
+				ulong uR = Math.Min(v[1].Rounds, ulong.MaxValue >> 1);
+				uRounds = (uL + uR) / 2;
+
+				return true;
+			}
+			return false;
+		}
+
+		private static void GCryptBenchmarkTh(object o)
+		{
+			IntPtr h = IntPtr.Zero;
+			try
+			{
+				GCryptTransformInfo ti = (o as GCryptTransformInfo);
+				if(ti == null) { Debug.Assert(false); return; }
+
+				if(!GCryptInitCipher(ref h, ti)) return;
+
+				ulong r = 0;
+				IntPtr n16 = new IntPtr(16);
+				int tStart = Environment.TickCount;
+				while(true)
+				{
+					for(ulong j = 0; j < BenchStep; ++j)
+					{
+						if(NativeMethods.gcry_cipher_encrypt(h, ti.Data16, n16,
+							IntPtr.Zero, IntPtr.Zero) != 0)
+						{
+							Debug.Assert(false);
+							return;
+						}
+					}
+
+					r += BenchStep;
+					if(r < BenchStep) // Overflow check
+					{
+						r = ulong.MaxValue;
+						break;
+					}
+
+					uint tElapsed = (uint)(Environment.TickCount - tStart);
+					if(tElapsed > ti.TimeMs) break;
+				}
+
+				ti.Rounds = r;
+				ti.Success = true;
+			}
+			catch(Exception) { Debug.Assert(false); }
+			finally
+			{
+				try { if(h != IntPtr.Zero) NativeMethods.gcry_cipher_close(h); }
+				catch(Exception) { Debug.Assert(false); }
+			}
+		} */
+
+		// =============================================================
+		// Single-threaded implementation
+
+		private static bool GCryptInitCipher(ref IntPtr h, IntPtr pSeed32)
+		{
+			NativeMethods.gcry_cipher_open(ref h, NativeMethods.GCRY_CIPHER_AES256,
+				NativeMethods.GCRY_CIPHER_MODE_ECB, 0);
+			if(h == IntPtr.Zero) { Debug.Assert(false); return false; }
+
+			IntPtr n32 = new IntPtr(32);
+			if(NativeMethods.gcry_cipher_setkey(h, pSeed32, n32) != 0)
+			{
+				Debug.Assert(false);
+				return false;
+			}
+
+			return true;
+		}
+
+		private static bool GCryptBegin(byte[] pbData32, byte[] pbSeed32,
+			ref IntPtr h, ref IntPtr pData32, ref IntPtr pSeed32)
+		{
+			pData32 = Marshal.AllocCoTaskMem(32);
+			pSeed32 = Marshal.AllocCoTaskMem(32);
+
+			Marshal.Copy(pbData32, 0, pData32, 32);
+			Marshal.Copy(pbSeed32, 0, pSeed32, 32);
+
+			return GCryptInitCipher(ref h, pSeed32);
+		}
+
+		private static void GCryptEnd(IntPtr h, IntPtr pData32, IntPtr pSeed32)
+		{
+			NativeMethods.gcry_cipher_close(h);
+
+			Marshal.WriteInt64(pData32, 0);
+			Marshal.WriteInt64(pData32, 8, 0);
+			Marshal.WriteInt64(pData32, 16, 0);
+			Marshal.WriteInt64(pData32, 24, 0);
+
+			Marshal.FreeCoTaskMem(pData32);
+			Marshal.FreeCoTaskMem(pSeed32);
+		}
+
+		private static bool TransformKeyGCryptPriv(byte[] pbData32, byte[] pbSeed32,
+			ulong uRounds)
+		{
+			IntPtr h = IntPtr.Zero, pData32 = IntPtr.Zero, pSeed32 = IntPtr.Zero;
+			if(!GCryptBegin(pbData32, pbSeed32, ref h, ref pData32, ref pSeed32))
+				return false;
+
+			try
+			{
+				IntPtr n32 = new IntPtr(32);
+				for(ulong i = 0; i < uRounds; ++i)
+				{
+					if(NativeMethods.gcry_cipher_encrypt(h, pData32, n32,
+						IntPtr.Zero, IntPtr.Zero) != 0)
+					{
+						Debug.Assert(false);
+						return false;
+					}
+				}
+
+				Marshal.Copy(pData32, pbData32, 0, 32);
+				return true;
+			}
+			catch(Exception) { Debug.Assert(false); }
+			finally { GCryptEnd(h, pData32, pSeed32); }
+
+			return false;
+		}
+
+		private static bool TransformKeyBenchmarkGCryptPriv(uint uTimeMs, ref ulong uRounds)
+		{
+			byte[] pbData32 = new byte[32];
+			byte[] pbSeed32 = new byte[32];
+
+			IntPtr h = IntPtr.Zero, pData32 = IntPtr.Zero, pSeed32 = IntPtr.Zero;
+			if(!GCryptBegin(pbData32, pbSeed32, ref h, ref pData32, ref pSeed32))
+				return false;
+
+			uint uMaxMs = uTimeMs;
+			ulong uDiv = 1;
+			if(uMaxMs <= (uint.MaxValue >> 1)) { uMaxMs *= 2U; uDiv = 2; }
+
+			try
+			{
+				ulong r = 0;
+				IntPtr n32 = new IntPtr(32);
+				int tStart = Environment.TickCount;
+				while(true)
+				{
+					for(ulong j = 0; j < BenchStep; ++j)
+					{
+						if(NativeMethods.gcry_cipher_encrypt(h, pData32, n32,
+							IntPtr.Zero, IntPtr.Zero) != 0)
+						{
+							Debug.Assert(false);
+							return false;
+						}
+					}
+
+					r += BenchStep;
+					if(r < BenchStep) // Overflow check
+					{
+						r = ulong.MaxValue;
+						break;
+					}
+
+					uint tElapsed = (uint)(Environment.TickCount - tStart);
+					if(tElapsed > uMaxMs) break;
+				}
+
+				uRounds = r / uDiv;
+				return true;
+			}
+			catch(Exception) { Debug.Assert(false); }
+			finally { GCryptEnd(h, pData32, pSeed32); }
+
+			return false;
+		}
+	}
+}

ModernKeePassLib/Cryptography/KeyDerivation/AesKdf.cs

@@ -0,0 +1,281 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Text;
+
+#if KeePassUAP
+using Org.BouncyCastle.Crypto;
+using Org.BouncyCastle.Crypto.Engines;
+using Org.BouncyCastle.Crypto.Parameters;
+#else
+using System.Security.Cryptography;
+#endif
+
+using ModernKeePassLib.Cryptography;
+using ModernKeePassLib.Native;
+using ModernKeePassLib.Utility;
+
+namespace ModernKeePassLib.Cryptography.KeyDerivation
+{
+	public sealed partial class AesKdf : KdfEngine
+	{
+		private static readonly PwUuid g_uuid = new PwUuid(new byte[] {
+			0xC9, 0xD9, 0xF3, 0x9A, 0x62, 0x8A, 0x44, 0x60,
+			0xBF, 0x74, 0x0D, 0x08, 0xC1, 0x8A, 0x4F, 0xEA });
+
+		public static readonly string ParamRounds = "R"; // UInt64
+		public static readonly string ParamSeed = "S"; // Byte[32]
+
+		private const ulong BenchStep = 3001;
+
+		public override PwUuid Uuid
+		{
+			get { return g_uuid; }
+		}
+
+		public override string Name
+		{
+			get { return "AES-KDF"; }
+		}
+
+		public AesKdf()
+		{
+		}
+
+		public override KdfParameters GetDefaultParameters()
+		{
+			KdfParameters p = base.GetDefaultParameters();
+			p.SetUInt64(ParamRounds, PwDefs.DefaultKeyEncryptionRounds);
+			return p;
+		}
+
+		public override void Randomize(KdfParameters p)
+		{
+			if(p == null) { Debug.Assert(false); return; }
+			Debug.Assert(g_uuid.Equals(p.KdfUuid));
+
+			byte[] pbSeed = CryptoRandom.Instance.GetRandomBytes(32);
+			p.SetByteArray(ParamSeed, pbSeed);
+		}
+
+		public override byte[] Transform(byte[] pbMsg, KdfParameters p)
+		{
+			if(pbMsg == null) throw new ArgumentNullException("pbMsg");
+			if(p == null) throw new ArgumentNullException("p");
+
+			Type tRounds = p.GetTypeOf(ParamRounds);
+			if(tRounds == null) throw new ArgumentNullException("p.Rounds");
+			if(tRounds != typeof(ulong)) throw new ArgumentOutOfRangeException("p.Rounds");
+			ulong uRounds = p.GetUInt64(ParamRounds, 0);
+
+			byte[] pbSeed = p.GetByteArray(ParamSeed);
+			if(pbSeed == null) throw new ArgumentNullException("p.Seed");
+
+			if(pbMsg.Length != 32)
+			{
+				Debug.Assert(false);
+				pbMsg = CryptoUtil.HashSha256(pbMsg);
+			}
+
+			if(pbSeed.Length != 32)
+			{
+				Debug.Assert(false);
+				pbSeed = CryptoUtil.HashSha256(pbSeed);
+			}
+
+			return TransformKey(pbMsg, pbSeed, uRounds);
+		}
+
+		private static byte[] TransformKey(byte[] pbOriginalKey32, byte[] pbKeySeed32,
+			ulong uNumRounds)
+		{
+			Debug.Assert((pbOriginalKey32 != null) && (pbOriginalKey32.Length == 32));
+			if(pbOriginalKey32 == null) throw new ArgumentNullException("pbOriginalKey32");
+			if(pbOriginalKey32.Length != 32) throw new ArgumentException();
+
+			Debug.Assert((pbKeySeed32 != null) && (pbKeySeed32.Length == 32));
+			if(pbKeySeed32 == null) throw new ArgumentNullException("pbKeySeed32");
+			if(pbKeySeed32.Length != 32) throw new ArgumentException();
+
+			byte[] pbNewKey = new byte[32];
+			Array.Copy(pbOriginalKey32, pbNewKey, pbNewKey.Length);
+
+			try
+			{
+#if !ModernKeePassLib
+				if(NativeLib.TransformKey256(pbNewKey, pbKeySeed32, uNumRounds))
+					return CryptoUtil.HashSha256(pbNewKey);
+#endif
+
+				if(TransformKeyGCrypt(pbNewKey, pbKeySeed32, uNumRounds))
+					return CryptoUtil.HashSha256(pbNewKey);
+
+				if(TransformKeyManaged(pbNewKey, pbKeySeed32, uNumRounds))
+					return CryptoUtil.HashSha256(pbNewKey);
+			}
+			finally { MemUtil.ZeroByteArray(pbNewKey); }
+
+			return null;
+		}
+
+		public static bool TransformKeyManaged(byte[] pbNewKey32, byte[] pbKeySeed32,
+			ulong uNumRounds)
+		{
+#if KeePassUAP
+			KeyParameter kp = new KeyParameter(pbKeySeed32);
+			AesEngine aes = new AesEngine();
+			aes.Init(true, kp);
+
+			for(ulong u = 0; u < uNumRounds; ++u)
+			{
+				aes.ProcessBlock(pbNewKey32, 0, pbNewKey32, 0);
+				aes.ProcessBlock(pbNewKey32, 16, pbNewKey32, 16);
+			}
+
+			aes.Reset();
+#else
+			byte[] pbIV = new byte[16];
+
+			using(SymmetricAlgorithm a = CryptoUtil.CreateAes())
+			{
+				if(a.BlockSize != 128) // AES block size
+				{
+					Debug.Assert(false);
+					a.BlockSize = 128;
+				}
+				a.KeySize = 256;
+				a.Mode = CipherMode.ECB;
+
+				using(ICryptoTransform t = a.CreateEncryptor(pbKeySeed32, pbIV))
+				{
+					// !t.CanReuseTransform -- doesn't work with Mono
+					if((t == null) || (t.InputBlockSize != 16) ||
+						(t.OutputBlockSize != 16))
+					{
+						Debug.Assert(false);
+						return false;
+					}
+
+					for(ulong u = 0; u < uNumRounds; ++u)
+					{
+						t.TransformBlock(pbNewKey32, 0, 16, pbNewKey32, 0);
+						t.TransformBlock(pbNewKey32, 16, 16, pbNewKey32, 16);
+					}
+				}
+			}
+#endif
+
+			return true;
+		}
+
+		public override KdfParameters GetBestParameters(uint uMilliseconds)
+		{
+			KdfParameters p = GetDefaultParameters();
+			ulong uRounds;
+#if !ModernKeePassLib
+			// Try native method
+			if(NativeLib.TransformKeyBenchmark256(uMilliseconds, out uRounds))
+			{
+				p.SetUInt64(ParamRounds, uRounds);
+				return p;
+			}
+#endif
+			if(TransformKeyBenchmarkGCrypt(uMilliseconds, out uRounds))
+			{
+				p.SetUInt64(ParamRounds, uRounds);
+				return p;
+			}
+
+			byte[] pbKey = new byte[32];
+			byte[] pbNewKey = new byte[32];
+			for(int i = 0; i < pbKey.Length; ++i)
+			{
+				pbKey[i] = (byte)i;
+				pbNewKey[i] = (byte)i;
+			}
+
+#if KeePassUAP
+			KeyParameter kp = new KeyParameter(pbKey);
+			AesEngine aes = new AesEngine();
+			aes.Init(true, kp);
+#else
+			byte[] pbIV = new byte[16];
+
+			using(SymmetricAlgorithm a = CryptoUtil.CreateAes())
+			{
+				if(a.BlockSize != 128) // AES block size
+				{
+					Debug.Assert(false);
+					a.BlockSize = 128;
+				}
+				a.KeySize = 256;
+				a.Mode = CipherMode.ECB;
+
+				using(ICryptoTransform t = a.CreateEncryptor(pbKey, pbIV))
+				{
+					// !t.CanReuseTransform -- doesn't work with Mono
+					if((t == null) || (t.InputBlockSize != 16) ||
+						(t.OutputBlockSize != 16))
+					{
+						Debug.Assert(false);
+						p.SetUInt64(ParamRounds, PwDefs.DefaultKeyEncryptionRounds);
+						return p;
+					}
+#endif
+
+					uRounds = 0;
+					int tStart = Environment.TickCount;
+					while(true)
+					{
+						for(ulong j = 0; j < BenchStep; ++j)
+						{
+#if KeePassUAP
+							aes.ProcessBlock(pbNewKey, 0, pbNewKey, 0);
+							aes.ProcessBlock(pbNewKey, 16, pbNewKey, 16);
+#else
+							t.TransformBlock(pbNewKey, 0, 16, pbNewKey, 0);
+							t.TransformBlock(pbNewKey, 16, 16, pbNewKey, 16);
+#endif
+						}
+
+						uRounds += BenchStep;
+						if(uRounds < BenchStep) // Overflow check
+						{
+							uRounds = ulong.MaxValue;
+							break;
+						}
+
+						uint tElapsed = (uint)(Environment.TickCount - tStart);
+						if(tElapsed > uMilliseconds) break;
+					}
+
+					p.SetUInt64(ParamRounds, uRounds);
+#if KeePassUAP
+					aes.Reset();
+#else
+				}
+			}
+#endif
+			return p;
+		}
+	}
+}

ModernKeePassLib/Cryptography/KeyDerivation/Argon2Kdf.Core.cs

@@ -0,0 +1,637 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+// This implementation is based on the official reference C
+// implementation by Daniel Dinu and Dmitry Khovratovich (CC0 1.0).
+
+// Relative iterations (* = B2ROUND_ARRAYS \\ G_INLINED):
+//     * | false true
+// ------+-----------
+// false |  8885 9618
+//  true |  9009 9636
+#define ARGON2_B2ROUND_ARRAYS
+#define ARGON2_G_INLINED
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Runtime.InteropServices;
+using System.Text;
+using System.Threading;
+using System.Threading.Tasks;
+using ModernKeePassLib.Cryptography.Hash;
+using ModernKeePassLib.Utility;
+
+namespace ModernKeePassLib.Cryptography.KeyDerivation
+{
+	public sealed partial class Argon2Kdf : KdfEngine
+	{
+		private const ulong NbBlockSize = 1024;
+		private const ulong NbBlockSizeInQW = NbBlockSize / 8UL;
+		private const ulong NbSyncPoints = 4;
+
+		private const int NbPreHashDigestLength = 64;
+		private const int NbPreHashSeedLength = NbPreHashDigestLength + 8;
+
+#if ARGON2_B2ROUND_ARRAYS
+		private static int[][] g_vFBCols = null;
+		private static int[][] g_vFBRows = null;
+#endif
+
+		private sealed class Argon2Ctx
+		{
+			public uint Version = 0;
+
+			public ulong Lanes = 0;
+			public ulong TCost = 0;
+			public ulong MCost = 0;
+			public ulong MemoryBlocks = 0;
+			public ulong SegmentLength = 0;
+			public ulong LaneLength = 0;
+
+			public ulong[] Mem = null;
+		}
+
+		private sealed class Argon2ThreadInfo
+		{
+			public Argon2Ctx Context = null;
+			public ManualResetEvent Finished = new ManualResetEvent(false);
+
+			public ulong Pass = 0;
+			public ulong Lane = 0;
+			public ulong Slice = 0;
+			public ulong Index = 0;
+
+			public void Release()
+			{
+				if(this.Finished != null)
+				{
+					this.Finished.Dispose();
+					this.Finished = null;
+				}
+				else { Debug.Assert(false); }
+			}
+		}
+
+		private static byte[] Argon2d(byte[] pbMsg, byte[] pbSalt, uint uParallel,
+			ulong uMem, ulong uIt, int cbOut, uint uVersion, byte[] pbSecretKey,
+			byte[] pbAssocData)
+		{
+			pbSecretKey = (pbSecretKey ?? MemUtil.EmptyByteArray);
+			pbAssocData = (pbAssocData ?? MemUtil.EmptyByteArray);
+
+#if ARGON2_B2ROUND_ARRAYS
+			InitB2RoundIndexArrays();
+#endif
+
+			Argon2Ctx ctx = new Argon2Ctx();
+			ctx.Version = uVersion;
+
+			ctx.Lanes = uParallel;
+			ctx.TCost = uIt;
+			ctx.MCost = uMem / NbBlockSize;
+			ctx.MemoryBlocks = Math.Max(ctx.MCost, 2UL * NbSyncPoints * ctx.Lanes);
+
+			ctx.SegmentLength = ctx.MemoryBlocks / (ctx.Lanes * NbSyncPoints);
+			ctx.MemoryBlocks = ctx.SegmentLength * ctx.Lanes * NbSyncPoints;
+
+			ctx.LaneLength = ctx.SegmentLength * NbSyncPoints;
+
+			Debug.Assert(NbBlockSize == (NbBlockSizeInQW *
+#if ModernKeePassLib || KeePassUAP
+				(ulong)Marshal.SizeOf<ulong>()
+#else
+				(ulong)Marshal.SizeOf(typeof(ulong))
+#endif
+				));
+			ctx.Mem = new ulong[ctx.MemoryBlocks * NbBlockSizeInQW];
+
+			Blake2b h = new Blake2b();
+
+			// Initial hash
+			Debug.Assert(h.HashSize == (NbPreHashDigestLength * 8));
+			byte[] pbBuf = new byte[4];
+			MemUtil.UInt32ToBytesEx(uParallel, pbBuf, 0);
+			h.TransformBlock(pbBuf, 0, pbBuf.Length, pbBuf, 0);
+			MemUtil.UInt32ToBytesEx((uint)cbOut, pbBuf, 0);
+			h.TransformBlock(pbBuf, 0, pbBuf.Length, pbBuf, 0);
+			MemUtil.UInt32ToBytesEx((uint)ctx.MCost, pbBuf, 0);
+			h.TransformBlock(pbBuf, 0, pbBuf.Length, pbBuf, 0);
+			MemUtil.UInt32ToBytesEx((uint)uIt, pbBuf, 0);
+			h.TransformBlock(pbBuf, 0, pbBuf.Length, pbBuf, 0);
+			MemUtil.UInt32ToBytesEx(uVersion, pbBuf, 0);
+			h.TransformBlock(pbBuf, 0, pbBuf.Length, pbBuf, 0);
+			MemUtil.UInt32ToBytesEx(0, pbBuf, 0); // Argon2d type = 0
+			h.TransformBlock(pbBuf, 0, pbBuf.Length, pbBuf, 0);
+			MemUtil.UInt32ToBytesEx((uint)pbMsg.Length, pbBuf, 0);
+			h.TransformBlock(pbBuf, 0, pbBuf.Length, pbBuf, 0);
+			h.TransformBlock(pbMsg, 0, pbMsg.Length, pbMsg, 0);
+			MemUtil.UInt32ToBytesEx((uint)pbSalt.Length, pbBuf, 0);
+			h.TransformBlock(pbBuf, 0, pbBuf.Length, pbBuf, 0);
+			h.TransformBlock(pbSalt, 0, pbSalt.Length, pbSalt, 0);
+			MemUtil.UInt32ToBytesEx((uint)pbSecretKey.Length, pbBuf, 0);
+			h.TransformBlock(pbBuf, 0, pbBuf.Length, pbBuf, 0);
+			h.TransformBlock(pbSecretKey, 0, pbSecretKey.Length, pbSecretKey, 0);
+			MemUtil.UInt32ToBytesEx((uint)pbAssocData.Length, pbBuf, 0);
+			h.TransformBlock(pbBuf, 0, pbBuf.Length, pbBuf, 0);
+			h.TransformBlock(pbAssocData, 0, pbAssocData.Length, pbAssocData, 0);
+			h.TransformFinalBlock(MemUtil.EmptyByteArray, 0, 0);
+			byte[] pbH0 = h.Hash;
+			Debug.Assert(pbH0.Length == 64);
+
+			byte[] pbBlockHash = new byte[NbPreHashSeedLength];
+			Array.Copy(pbH0, pbBlockHash, pbH0.Length);
+			MemUtil.ZeroByteArray(pbH0);
+
+			FillFirstBlocks(ctx, pbBlockHash, h);
+			MemUtil.ZeroByteArray(pbBlockHash);
+
+			FillMemoryBlocks(ctx);
+
+			byte[] pbOut = FinalHash(ctx, cbOut, h);
+
+			h.Clear();
+			MemUtil.ZeroArray<ulong>(ctx.Mem);
+			return pbOut;
+		}
+
+		private static void LoadBlock(ulong[] pqDst, ulong uDstOffset, byte[] pbIn)
+		{
+			// for(ulong i = 0; i < NbBlockSizeInQW; ++i)
+			//	pqDst[uDstOffset + i] = MemUtil.BytesToUInt64(pbIn, (int)(i << 3));
+
+			Debug.Assert((uDstOffset + NbBlockSizeInQW - 1UL) <= (ulong)int.MaxValue);
+			int iDstOffset = (int)uDstOffset;
+			for(int i = 0; i < (int)NbBlockSizeInQW; ++i)
+				pqDst[iDstOffset + i] = MemUtil.BytesToUInt64(pbIn, i << 3);
+		}
+
+		private static void StoreBlock(byte[] pbDst, ulong[] pqSrc)
+		{
+			for(int i = 0; i < (int)NbBlockSizeInQW; ++i)
+				MemUtil.UInt64ToBytesEx(pqSrc[i], pbDst, i << 3);
+		}
+
+		private static void CopyBlock(ulong[] vDst, ulong uDstOffset, ulong[] vSrc,
+			ulong uSrcOffset)
+		{
+			// for(ulong i = 0; i < NbBlockSizeInQW; ++i)
+			//	vDst[uDstOffset + i] = vSrc[uSrcOffset + i];
+
+			// Debug.Assert((uDstOffset + NbBlockSizeInQW - 1UL) <= (ulong)int.MaxValue);
+			// Debug.Assert((uSrcOffset + NbBlockSizeInQW - 1UL) <= (ulong)int.MaxValue);
+			// int iDstOffset = (int)uDstOffset;
+			// int iSrcOffset = (int)uSrcOffset;
+			// for(int i = 0; i < (int)NbBlockSizeInQW; ++i)
+			//	vDst[iDstOffset + i] = vSrc[iSrcOffset + i];
+
+#if ModernKeePassLib || KeePassUAP
+			Array.Copy(vSrc, (int)uSrcOffset, vDst, (int)uDstOffset,
+				(int)NbBlockSizeInQW);
+#else
+			Array.Copy(vSrc, (long)uSrcOffset, vDst, (long)uDstOffset,
+				(long)NbBlockSizeInQW);
+#endif
+		}
+
+		private static void XorBlock(ulong[] vDst, ulong uDstOffset, ulong[] vSrc,
+			ulong uSrcOffset)
+		{
+			// for(ulong i = 0; i < NbBlockSizeInQW; ++i)
+			//	vDst[uDstOffset + i] ^= vSrc[uSrcOffset + i];
+
+			Debug.Assert((uDstOffset + NbBlockSizeInQW - 1UL) <= (ulong)int.MaxValue);
+			Debug.Assert((uSrcOffset + NbBlockSizeInQW - 1UL) <= (ulong)int.MaxValue);
+			int iDstOffset = (int)uDstOffset;
+			int iSrcOffset = (int)uSrcOffset;
+			for(int i = 0; i < (int)NbBlockSizeInQW; ++i)
+				vDst[iDstOffset + i] ^= vSrc[iSrcOffset + i];
+		}
+
+		private static void Blake2bLong(byte[] pbOut, int cbOut,
+			byte[] pbIn, int cbIn, Blake2b h)
+		{
+			Debug.Assert((h != null) && (h.HashSize == (64 * 8)));
+
+			byte[] pbOutLen = new byte[4];
+			MemUtil.UInt32ToBytesEx((uint)cbOut, pbOutLen, 0);
+
+			if(cbOut <= 64)
+			{
+				Blake2b hOut = ((cbOut == 64) ? h : new Blake2b(cbOut));
+				if(cbOut == 64) hOut.Initialize();
+
+				hOut.TransformBlock(pbOutLen, 0, pbOutLen.Length, pbOutLen, 0);
+				hOut.TransformBlock(pbIn, 0, cbIn, pbIn, 0);
+				hOut.TransformFinalBlock(MemUtil.EmptyByteArray, 0, 0);
+
+				Array.Copy(hOut.Hash, pbOut, cbOut);
+
+				if(cbOut < 64) hOut.Clear();
+				return;
+			}
+
+			h.Initialize();
+			h.TransformBlock(pbOutLen, 0, pbOutLen.Length, pbOutLen, 0);
+			h.TransformBlock(pbIn, 0, cbIn, pbIn, 0);
+			h.TransformFinalBlock(MemUtil.EmptyByteArray, 0, 0);
+
+			byte[] pbOutBuffer = new byte[64];
+			Array.Copy(h.Hash, pbOutBuffer, pbOutBuffer.Length);
+
+			int ibOut = 64 / 2;
+			Array.Copy(pbOutBuffer, pbOut, ibOut);
+			int cbToProduce = cbOut - ibOut;
+
+			h.Initialize();
+			while(cbToProduce > 64)
+			{
+				byte[] pbHash = h.ComputeHash(pbOutBuffer);
+				Array.Copy(pbHash, pbOutBuffer, 64);
+
+				Array.Copy(pbHash, 0, pbOut, ibOut, 64 / 2);
+				ibOut += 64 / 2;
+				cbToProduce -= 64 / 2;
+
+				MemUtil.ZeroByteArray(pbHash);
+			}
+
+			using(Blake2b hOut = new Blake2b(cbToProduce))
+			{
+				byte[] pbHash = hOut.ComputeHash(pbOutBuffer);
+				Array.Copy(pbHash, 0, pbOut, ibOut, cbToProduce);
+
+				MemUtil.ZeroByteArray(pbHash);
+			}
+
+			MemUtil.ZeroByteArray(pbOutBuffer);
+		}
+
+#if !ARGON2_G_INLINED
+		private static ulong BlaMka(ulong x, ulong y)
+		{
+			ulong xy = (x & 0xFFFFFFFFUL) * (y & 0xFFFFFFFFUL);
+			return (x + y + (xy << 1));
+		}
+
+		private static void G(ulong[] v, int a, int b, int c, int d)
+		{
+			ulong va = v[a], vb = v[b], vc = v[c], vd = v[d];
+
+			va = BlaMka(va, vb);
+			vd = MemUtil.RotateRight64(vd ^ va, 32);
+			vc = BlaMka(vc, vd);
+			vb = MemUtil.RotateRight64(vb ^ vc, 24);
+			va = BlaMka(va, vb);
+			vd = MemUtil.RotateRight64(vd ^ va, 16);
+			vc = BlaMka(vc, vd);
+			vb = MemUtil.RotateRight64(vb ^ vc, 63);
+
+			v[a] = va;
+			v[b] = vb;
+			v[c] = vc;
+			v[d] = vd;
+		}
+#else
+		private static void G(ulong[] v, int a, int b, int c, int d)
+		{
+			ulong va = v[a], vb = v[b], vc = v[c], vd = v[d];
+
+			ulong xy = (va & 0xFFFFFFFFUL) * (vb & 0xFFFFFFFFUL);
+			va += vb + (xy << 1);
+
+			vd = MemUtil.RotateRight64(vd ^ va, 32);
+
+			xy = (vc & 0xFFFFFFFFUL) * (vd & 0xFFFFFFFFUL);
+			vc += vd + (xy << 1);
+
+			vb = MemUtil.RotateRight64(vb ^ vc, 24);
+
+			xy = (va & 0xFFFFFFFFUL) * (vb & 0xFFFFFFFFUL);
+			va += vb + (xy << 1);
+
+			vd = MemUtil.RotateRight64(vd ^ va, 16);
+
+			xy = (vc & 0xFFFFFFFFUL) * (vd & 0xFFFFFFFFUL);
+			vc += vd + (xy << 1);
+
+			vb = MemUtil.RotateRight64(vb ^ vc, 63);
+
+			v[a] = va;
+			v[b] = vb;
+			v[c] = vc;
+			v[d] = vd;
+		}
+#endif
+
+#if ARGON2_B2ROUND_ARRAYS
+		private static void Blake2RoundNoMsg(ulong[] pbR, int[] v)
+		{
+			G(pbR, v[0], v[4], v[8], v[12]);
+			G(pbR, v[1], v[5], v[9], v[13]);
+			G(pbR, v[2], v[6], v[10], v[14]);
+			G(pbR, v[3], v[7], v[11], v[15]);
+			G(pbR, v[0], v[5], v[10], v[15]);
+			G(pbR, v[1], v[6], v[11], v[12]);
+			G(pbR, v[2], v[7], v[8], v[13]);
+			G(pbR, v[3], v[4], v[9], v[14]);
+		}
+#else
+		private static void Blake2RoundNoMsgCols16i(ulong[] pbR, int i)
+		{
+			G(pbR, i,     i + 4, i +  8, i + 12);
+			G(pbR, i + 1, i + 5, i +  9, i + 13);
+			G(pbR, i + 2, i + 6, i + 10, i + 14);
+			G(pbR, i + 3, i + 7, i + 11, i + 15);
+			G(pbR, i,     i + 5, i + 10, i + 15);
+			G(pbR, i + 1, i + 6, i + 11, i + 12);
+			G(pbR, i + 2, i + 7, i +  8, i + 13);
+			G(pbR, i + 3, i + 4, i +  9, i + 14);
+		}
+
+		private static void Blake2RoundNoMsgRows2i(ulong[] pbR, int i)
+		{
+			G(pbR, i,      i + 32, i + 64, i +  96);
+			G(pbR, i +  1, i + 33, i + 65, i +  97);
+			G(pbR, i + 16, i + 48, i + 80, i + 112);
+			G(pbR, i + 17, i + 49, i + 81, i + 113);
+			G(pbR, i,      i + 33, i + 80, i + 113);
+			G(pbR, i +  1, i + 48, i + 81, i +  96);
+			G(pbR, i + 16, i + 49, i + 64, i +  97);
+			G(pbR, i + 17, i + 32, i + 65, i + 112);
+		}
+#endif
+
+		private static void FillFirstBlocks(Argon2Ctx ctx, byte[] pbBlockHash,
+			Blake2b h)
+		{
+			byte[] pbBlock = new byte[NbBlockSize];
+
+			for(ulong l = 0; l < ctx.Lanes; ++l)
+			{
+				MemUtil.UInt32ToBytesEx(0, pbBlockHash, NbPreHashDigestLength);
+				MemUtil.UInt32ToBytesEx((uint)l, pbBlockHash, NbPreHashDigestLength + 4);
+
+				Blake2bLong(pbBlock, (int)NbBlockSize, pbBlockHash,
+					NbPreHashSeedLength, h);
+				LoadBlock(ctx.Mem, l * ctx.LaneLength * NbBlockSizeInQW, pbBlock);
+
+				MemUtil.UInt32ToBytesEx(1, pbBlockHash, NbPreHashDigestLength);
+
+				Blake2bLong(pbBlock, (int)NbBlockSize, pbBlockHash,
+					NbPreHashSeedLength, h);
+				LoadBlock(ctx.Mem, (l * ctx.LaneLength + 1UL) * NbBlockSizeInQW, pbBlock);
+			}
+
+			MemUtil.ZeroByteArray(pbBlock);
+		}
+
+		private static ulong IndexAlpha(Argon2Ctx ctx, Argon2ThreadInfo ti,
+			uint uPseudoRand, bool bSameLane)
+		{
+			ulong uRefAreaSize;
+			if(ti.Pass == 0)
+			{
+				if(ti.Slice == 0)
+				{
+					Debug.Assert(ti.Index > 0);
+					uRefAreaSize = ti.Index - 1UL;
+				}
+				else
+				{
+					if(bSameLane)
+						uRefAreaSize = ti.Slice * ctx.SegmentLength +
+							ti.Index - 1UL;
+					else
+						uRefAreaSize = ti.Slice * ctx.SegmentLength -
+							((ti.Index == 0UL) ? 1UL : 0UL);
+				}
+			}
+			else
+			{
+				if(bSameLane)
+					uRefAreaSize = ctx.LaneLength - ctx.SegmentLength +
+						ti.Index - 1UL;
+				else
+					uRefAreaSize = ctx.LaneLength - ctx.SegmentLength -
+						((ti.Index == 0) ? 1UL : 0UL);
+			}
+			Debug.Assert(uRefAreaSize <= (ulong)uint.MaxValue);
+
+			ulong uRelPos = uPseudoRand;
+			uRelPos = (uRelPos * uRelPos) >> 32;
+			uRelPos = uRefAreaSize - 1UL - ((uRefAreaSize * uRelPos) >> 32);
+
+			ulong uStart = 0;
+			if(ti.Pass != 0)
+				uStart = (((ti.Slice + 1UL) == NbSyncPoints) ? 0UL :
+					((ti.Slice + 1UL) * ctx.SegmentLength));
+			Debug.Assert(uStart <= (ulong)uint.MaxValue);
+
+			Debug.Assert(ctx.LaneLength <= (ulong)uint.MaxValue);
+			return ((uStart + uRelPos) % ctx.LaneLength);
+		}
+
+		private static void FillMemoryBlocks(Argon2Ctx ctx)
+		{
+			int np = (int)ctx.Lanes;
+			Argon2ThreadInfo[] v = new Argon2ThreadInfo[np];
+
+			for(ulong r = 0; r < ctx.TCost; ++r)
+			{
+				for(ulong s = 0; s < NbSyncPoints; ++s)
+				{
+					for(int l = 0; l < np; ++l)
+					{
+						Argon2ThreadInfo ti = new Argon2ThreadInfo();
+						ti.Context = ctx;
+
+						ti.Pass = r;
+						ti.Lane = (ulong)l;
+						ti.Slice = s;
+
+#if ModernKeePassLib
+					    Task.Factory.StartNew(FillSegmentThr, ti);
+					    //ThreadPool.RunAsync(a => FillSegmentThr(ti));
+#else
+						if(!ThreadPool.QueueUserWorkItem(FillSegmentThr, ti))
+						{
+							Debug.Assert(false);
+							throw new OutOfMemoryException();
+						}
+#endif
+						v[l] = ti;
+					}
+
+					for(int l = 0; l < np; ++l)
+					{
+						v[l].Finished.WaitOne();
+						v[l].Release();
+					}
+				}
+			}
+		}
+
+		private static void FillSegmentThr(object o)
+		{
+			Argon2ThreadInfo ti = (o as Argon2ThreadInfo);
+			if(ti == null) { Debug.Assert(false); return; }
+
+			try
+			{
+				Argon2Ctx ctx = ti.Context;
+				if(ctx == null) { Debug.Assert(false); return; }
+
+				Debug.Assert(ctx.Version >= MinVersion);
+				bool bCanXor = (ctx.Version >= 0x13U);
+
+				ulong uStart = 0;
+				if((ti.Pass == 0) && (ti.Slice == 0)) uStart = 2;
+
+				ulong uCur = (ti.Lane * ctx.LaneLength) + (ti.Slice *
+					ctx.SegmentLength) + uStart;
+
+				ulong uPrev = (((uCur % ctx.LaneLength) == 0) ?
+					(uCur + ctx.LaneLength - 1UL) : (uCur - 1UL));
+
+				ulong[] pbR = new ulong[NbBlockSizeInQW];
+				ulong[] pbTmp = new ulong[NbBlockSizeInQW];
+
+				for(ulong i = uStart; i < ctx.SegmentLength; ++i)
+				{
+					if((uCur % ctx.LaneLength) == 1)
+						uPrev = uCur - 1UL;
+
+					ulong uPseudoRand = ctx.Mem[uPrev * NbBlockSizeInQW];
+					ulong uRefLane = (uPseudoRand >> 32) % ctx.Lanes;
+					if((ti.Pass == 0) && (ti.Slice == 0))
+						uRefLane = ti.Lane;
+
+					ti.Index = i;
+					ulong uRefIndex = IndexAlpha(ctx, ti, (uint)uPseudoRand,
+						(uRefLane == ti.Lane));
+
+					ulong uRefBlockIndex = (ctx.LaneLength * uRefLane +
+						uRefIndex) * NbBlockSizeInQW;
+					ulong uCurBlockIndex = uCur * NbBlockSizeInQW;
+
+					FillBlock(ctx.Mem, uPrev * NbBlockSizeInQW, uRefBlockIndex,
+						uCurBlockIndex, ((ti.Pass != 0) && bCanXor), pbR, pbTmp);
+
+					++uCur;
+					++uPrev;
+				}
+
+				MemUtil.ZeroArray<ulong>(pbR);
+				MemUtil.ZeroArray<ulong>(pbTmp);
+			}
+			catch(Exception) { Debug.Assert(false); }
+
+			try { ti.Finished.Set(); }
+			catch(Exception) { Debug.Assert(false); }
+		}
+
+#if ARGON2_B2ROUND_ARRAYS
+		private static void InitB2RoundIndexArrays()
+		{
+			int[][] vCols = g_vFBCols;
+			if(vCols == null)
+			{
+				vCols = new int[8][];
+				Debug.Assert(vCols.Length == 8);
+				int e = 0;
+				for(int i = 0; i < 8; ++i)
+				{
+					vCols[i] = new int[16];
+					for(int j = 0; j < 16; ++j)
+					{
+						vCols[i][j] = e;
+						++e;
+					}
+				}
+
+				g_vFBCols = vCols;
+			}
+
+			int[][] vRows = g_vFBRows;
+			if(vRows == null)
+			{
+				vRows = new int[8][];
+				for(int i = 0; i < 8; ++i)
+				{
+					vRows[i] = new int[16];
+					for(int j = 0; j < 16; ++j)
+					{
+						int jh = j / 2;
+						vRows[i][j] = (2 * i) + (16 * jh) + (j & 1);
+					}
+				}
+
+				g_vFBRows = vRows;
+			}
+		}
+#endif
+
+		private static void FillBlock(ulong[] pMem, ulong uPrev, ulong uRef,
+			ulong uNext, bool bXor, ulong[] pbR, ulong[] pbTmp)
+		{
+			CopyBlock(pbR, 0, pMem, uRef);
+			XorBlock(pbR, 0, pMem, uPrev);
+			CopyBlock(pbTmp, 0, pbR, 0);
+			if(bXor) XorBlock(pbTmp, 0, pMem, uNext);
+
+#if ARGON2_B2ROUND_ARRAYS
+			int[][] vCols = g_vFBCols;
+			int[][] vRows = g_vFBRows;
+			for(int i = 0; i < 8; ++i)
+				Blake2RoundNoMsg(pbR, vCols[i]);
+			for(int i = 0; i < 8; ++i)
+				Blake2RoundNoMsg(pbR, vRows[i]);
+#else
+			for(int i = 0; i < (8 * 16); i += 16)
+				Blake2RoundNoMsgCols16i(pbR, i);
+			for(int i = 0; i < (8 * 2); i += 2)
+				Blake2RoundNoMsgRows2i(pbR, i);
+#endif
+
+			CopyBlock(pMem, uNext, pbTmp, 0);
+			XorBlock(pMem, uNext, pbR, 0);
+		}
+
+		private static byte[] FinalHash(Argon2Ctx ctx, int cbOut, Blake2b h)
+		{
+			ulong[] pqBlockHash = new ulong[NbBlockSizeInQW];
+			CopyBlock(pqBlockHash, 0, ctx.Mem, (ctx.LaneLength - 1UL) *
+				NbBlockSizeInQW);
+			for(ulong l = 1; l < ctx.Lanes; ++l)
+				XorBlock(pqBlockHash, 0, ctx.Mem, (l * ctx.LaneLength +
+					ctx.LaneLength - 1UL) * NbBlockSizeInQW);
+
+			byte[] pbBlockHashBytes = new byte[NbBlockSize];
+			StoreBlock(pbBlockHashBytes, pqBlockHash);
+
+			byte[] pbOut = new byte[cbOut];
+			Blake2bLong(pbOut, cbOut, pbBlockHashBytes, (int)NbBlockSize, h);
+
+			MemUtil.ZeroArray<ulong>(pqBlockHash);
+			MemUtil.ZeroByteArray(pbBlockHashBytes);
+			return pbOut;
+		}
+	}
+}

ModernKeePassLib/Cryptography/KeyDerivation/Argon2Kdf.cs

@@ -0,0 +1,144 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Text;
+
+namespace ModernKeePassLib.Cryptography.KeyDerivation
+{
+	public sealed partial class Argon2Kdf : KdfEngine
+	{
+		private static readonly PwUuid g_uuid = new PwUuid(new byte[] {
+			0xEF, 0x63, 0x6D, 0xDF, 0x8C, 0x29, 0x44, 0x4B,
+			0x91, 0xF7, 0xA9, 0xA4, 0x03, 0xE3, 0x0A, 0x0C });
+
+		public static readonly string ParamSalt = "S"; // Byte[]
+		public static readonly string ParamParallelism = "P"; // UInt32
+		public static readonly string ParamMemory = "M"; // UInt64
+		public static readonly string ParamIterations = "I"; // UInt64
+		public static readonly string ParamVersion = "V"; // UInt32
+		public static readonly string ParamSecretKey = "K"; // Byte[]
+		public static readonly string ParamAssocData = "A"; // Byte[]
+
+		private const uint MinVersion = 0x10;
+		private const uint MaxVersion = 0x13;
+
+		private const int MinSalt = 8;
+		private const int MaxSalt = int.MaxValue; // .NET limit; 2^32 - 1 in spec
+
+		internal const ulong MinIterations = 1;
+		internal const ulong MaxIterations = uint.MaxValue;
+
+		internal const ulong MinMemory = 1024 * 8; // For parallelism = 1
+		// internal const ulong MaxMemory = (ulong)uint.MaxValue * 1024UL; // Spec
+		internal const ulong MaxMemory = int.MaxValue; // .NET limit
+
+		internal const uint MinParallelism = 1;
+		internal const uint MaxParallelism = (1 << 24) - 1;
+
+		internal const ulong DefaultIterations = 2;
+		internal const ulong DefaultMemory = 1024 * 1024; // 1 MB
+		internal const uint DefaultParallelism = 2;
+
+		public override PwUuid Uuid
+		{
+			get { return g_uuid; }
+		}
+
+		public override string Name
+		{
+			get { return "Argon2"; }
+		}
+
+		public Argon2Kdf()
+		{
+		}
+
+		public override KdfParameters GetDefaultParameters()
+		{
+			KdfParameters p = base.GetDefaultParameters();
+
+			p.SetUInt32(ParamVersion, MaxVersion);
+
+			p.SetUInt64(ParamIterations, DefaultIterations);
+			p.SetUInt64(ParamMemory, DefaultMemory);
+			p.SetUInt32(ParamParallelism, DefaultParallelism);
+
+			return p;
+		}
+
+		public override void Randomize(KdfParameters p)
+		{
+			if(p == null) { Debug.Assert(false); return; }
+			Debug.Assert(g_uuid.Equals(p.KdfUuid));
+
+			byte[] pb = CryptoRandom.Instance.GetRandomBytes(32);
+			p.SetByteArray(ParamSalt, pb);
+		}
+
+		public override byte[] Transform(byte[] pbMsg, KdfParameters p)
+		{
+			if(pbMsg == null) throw new ArgumentNullException("pbMsg");
+			if(p == null) throw new ArgumentNullException("p");
+
+			byte[] pbSalt = p.GetByteArray(ParamSalt);
+			if(pbSalt == null)
+				throw new ArgumentNullException("p.Salt");
+			if((pbSalt.Length < MinSalt) || (pbSalt.Length > MaxSalt))
+				throw new ArgumentOutOfRangeException("p.Salt");
+
+			uint uPar = p.GetUInt32(ParamParallelism, 0);
+			if((uPar < MinParallelism) || (uPar > MaxParallelism))
+				throw new ArgumentOutOfRangeException("p.Parallelism");
+
+			ulong uMem = p.GetUInt64(ParamMemory, 0);
+			if((uMem < MinMemory) || (uMem > MaxMemory))
+				throw new ArgumentOutOfRangeException("p.Memory");
+
+			ulong uIt = p.GetUInt64(ParamIterations, 0);
+			if((uIt < MinIterations) || (uIt > MaxIterations))
+				throw new ArgumentOutOfRangeException("p.Iterations");
+
+			uint v = p.GetUInt32(ParamVersion, 0);
+			if((v < MinVersion) || (v > MaxVersion))
+				throw new ArgumentOutOfRangeException("p.Version");
+
+			byte[] pbSecretKey = p.GetByteArray(ParamSecretKey);
+			byte[] pbAssocData = p.GetByteArray(ParamAssocData);
+
+			byte[] pbRet = Argon2d(pbMsg, pbSalt, uPar, uMem, uIt,
+				32, v, pbSecretKey, pbAssocData);
+
+			if(uMem > (100UL * 1024UL * 1024UL)) GC.Collect();
+			return pbRet;
+		}
+
+		public override KdfParameters GetBestParameters(uint uMilliseconds)
+		{
+			KdfParameters p = GetDefaultParameters();
+			Randomize(p);
+
+			MaximizeParamUInt64(p, ParamIterations, MinIterations,
+				MaxIterations, uMilliseconds, true);
+			return p;
+		}
+	}
+}

ModernKeePassLib/Cryptography/KeyDerivation/KdfEngine.cs

@@ -0,0 +1,142 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Text;
+
+namespace ModernKeePassLib.Cryptography.KeyDerivation
+{
+	public abstract class KdfEngine
+	{
+		public abstract PwUuid Uuid
+		{
+			get;
+		}
+
+		public abstract string Name
+		{
+			get;
+		}
+
+		public virtual KdfParameters GetDefaultParameters()
+		{
+			return new KdfParameters(this.Uuid);
+		}
+
+		/// <summary>
+		/// Generate random seeds and store them in <paramref name="p" />.
+		/// </summary>
+		public virtual void Randomize(KdfParameters p)
+		{
+			Debug.Assert(p != null);
+			Debug.Assert(p.KdfUuid.Equals(this.Uuid));
+		}
+
+		public abstract byte[] Transform(byte[] pbMsg, KdfParameters p);
+
+		public virtual KdfParameters GetBestParameters(uint uMilliseconds)
+		{
+			throw new NotImplementedException();
+		}
+
+		protected void MaximizeParamUInt64(KdfParameters p, string strName,
+			ulong uMin, ulong uMax, uint uMilliseconds, bool bInterpSearch)
+		{
+			if(p == null) { Debug.Assert(false); return; }
+			if(string.IsNullOrEmpty(strName)) { Debug.Assert(false); return; }
+			if(uMin > uMax) { Debug.Assert(false); return; }
+
+			if(uMax > (ulong.MaxValue >> 1))
+			{
+				Debug.Assert(false);
+				uMax = ulong.MaxValue >> 1;
+
+				if(uMin > uMax) { p.SetUInt64(strName, uMin); return; }
+			}
+
+			byte[] pbMsg = new byte[32];
+			for(int i = 0; i < pbMsg.Length; ++i) pbMsg[i] = (byte)i;
+
+			ulong uLow = uMin;
+			ulong uHigh = uMin + 1UL;
+			long tLow = 0;
+			long tHigh = 0;
+			long tTarget = (long)uMilliseconds;
+
+			// Determine range
+			while(uHigh <= uMax)
+			{
+				p.SetUInt64(strName, uHigh);
+
+				// GC.Collect();
+				Stopwatch sw = Stopwatch.StartNew();
+				Transform(pbMsg, p);
+				sw.Stop();
+
+				tHigh = sw.ElapsedMilliseconds;
+				if(tHigh > tTarget) break;
+
+				uLow = uHigh;
+				tLow = tHigh;
+				uHigh <<= 1;
+			}
+			if(uHigh > uMax) { uHigh = uMax; tHigh = 0; }
+			if(uLow > uHigh) uLow = uHigh; // Skips to end
+
+			// Find optimal number of iterations
+			while((uHigh - uLow) >= 2UL)
+			{
+				ulong u = (uHigh + uLow) >> 1; // Binary search
+				// Interpolation search, if possible
+				if(bInterpSearch && (tLow > 0) && (tHigh > tTarget) &&
+					(tLow <= tTarget))
+				{
+					u = uLow + (((uHigh - uLow) * (ulong)(tTarget - tLow)) /
+						(ulong)(tHigh - tLow));
+					if((u >= uLow) && (u <= uHigh))
+					{
+						u = Math.Max(u, uLow + 1UL);
+						u = Math.Min(u, uHigh - 1UL);
+					}
+					else
+					{
+						Debug.Assert(false);
+						u = (uHigh + uLow) >> 1;
+					}
+				}
+
+				p.SetUInt64(strName, u);
+
+				// GC.Collect();
+				Stopwatch sw = Stopwatch.StartNew();
+				Transform(pbMsg, p);
+				sw.Stop();
+
+				long t = sw.ElapsedMilliseconds;
+				if(t == tTarget) { uLow = u; break; }
+				else if(t > tTarget) { uHigh = u; tHigh = t; }
+				else { uLow = u; tLow = t; }
+			}
+
+			p.SetUInt64(strName, uLow);
+		}
+	}
+}

ModernKeePassLib/Cryptography/KeyDerivation/KdfParameters.cs

@@ -0,0 +1,80 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.IO;
+using System.Text;
+
+using ModernKeePassLib.Collections;
+using ModernKeePassLib.Utility;
+
+namespace ModernKeePassLib.Cryptography.KeyDerivation
+{
+	public sealed class KdfParameters : VariantDictionary
+	{
+		private const string ParamUuid = @"$UUID";
+
+		private readonly PwUuid m_puKdf;
+		public PwUuid KdfUuid
+		{
+			get { return m_puKdf; }
+		}
+
+		public KdfParameters(PwUuid puKdf)
+		{
+			if(puKdf == null) throw new ArgumentNullException("puKdf");
+
+			m_puKdf = puKdf;
+			SetByteArray(ParamUuid, puKdf.UuidBytes);
+		}
+
+		/// <summary>
+		/// Unsupported.
+		/// </summary>
+		public override object Clone()
+		{
+			throw new NotSupportedException();
+		}
+
+		public static byte[] SerializeExt(KdfParameters p)
+		{
+			return VariantDictionary.Serialize(p);
+		}
+
+		public static KdfParameters DeserializeExt(byte[] pb)
+		{
+			VariantDictionary d = VariantDictionary.Deserialize(pb);
+			if(d == null) { Debug.Assert(false); return null; }
+
+			byte[] pbUuid = d.GetByteArray(ParamUuid);
+			if((pbUuid == null) || (pbUuid.Length != (int)PwUuid.UuidSize))
+			{
+				Debug.Assert(false);
+				return null;
+			}
+
+			PwUuid pu = new PwUuid(pbUuid);
+			KdfParameters p = new KdfParameters(pu);
+			d.CopyTo(p);
+			return p;
+		}
+	}
+}

ModernKeePassLib/Cryptography/KeyDerivation/KdfPool.cs

@@ -0,0 +1,96 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Text;
+
+using ModernKeePassLib.Utility;
+
+namespace ModernKeePassLib.Cryptography.KeyDerivation
+{
+	public static class KdfPool
+	{
+		private static List<KdfEngine> g_l = new List<KdfEngine>();
+
+		public static IEnumerable<KdfEngine> Engines
+		{
+			get
+			{
+				EnsureInitialized();
+				return g_l;
+			}
+		}
+
+		private static void EnsureInitialized()
+		{
+			if(g_l.Count > 0) return;
+
+			g_l.Add(new AesKdf());
+			g_l.Add(new Argon2Kdf());
+		}
+
+		internal static KdfParameters GetDefaultParameters()
+		{
+			EnsureInitialized();
+			return g_l[0].GetDefaultParameters();
+		}
+
+		public static KdfEngine Get(PwUuid pu)
+		{
+			if(pu == null) { Debug.Assert(false); return null; }
+
+			EnsureInitialized();
+
+			foreach(KdfEngine kdf in g_l)
+			{
+				if(pu.Equals(kdf.Uuid)) return kdf;
+			}
+
+			return null;
+		}
+
+		public static KdfEngine Get(string strName)
+		{
+			if(string.IsNullOrEmpty(strName)) { Debug.Assert(false); return null; }
+
+			EnsureInitialized();
+
+			foreach(KdfEngine kdf in g_l)
+			{
+				if(strName.Equals(kdf.Name, StrUtil.CaseIgnoreCmp)) return kdf;
+			}
+
+			return null;
+		}
+
+		public static void Add(KdfEngine kdf)
+		{
+			if(kdf == null) { Debug.Assert(false); return; }
+
+			EnsureInitialized();
+
+			if(Get(kdf.Uuid) != null) { Debug.Assert(false); return; }
+			if(Get(kdf.Name) != null) { Debug.Assert(false); return; }
+
+			g_l.Add(kdf);
+		}
+	}
+}

ModernKeePassLib/Cryptography/PasswordGenerator/CharSetBasedGenerator.cs

@@ -0,0 +1,64 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Text;
+
+using ModernKeePassLib.Security;
+using ModernKeePassLib.Utility;
+
+namespace ModernKeePassLib.Cryptography.PasswordGenerator
+{
+	internal static class CharSetBasedGenerator
+	{
+		internal static PwgError Generate(out ProtectedString psOut,
+			PwProfile pwProfile, CryptoRandomStream crsRandomSource)
+		{
+			psOut = ProtectedString.Empty;
+			if(pwProfile.Length == 0) return PwgError.Success;
+
+			PwCharSet pcs = new PwCharSet(pwProfile.CharSet.ToString());
+			PwGenerator.PrepareCharSet(pcs, pwProfile);
+
+			char[] v = new char[pwProfile.Length];
+			try
+			{
+				for(int i = 0; i < v.Length; ++i)
+				{
+					char ch = PwGenerator.GenerateCharacter(pwProfile,
+						pcs, crsRandomSource);
+
+					if(ch == char.MinValue)
+						return PwgError.TooFewCharacters;
+
+					v[i] = ch;
+				}
+
+				byte[] pbUtf8 = StrUtil.Utf8.GetBytes(v);
+				psOut = new ProtectedString(true, pbUtf8);
+				MemUtil.ZeroByteArray(pbUtf8);
+			}
+			finally { MemUtil.ZeroArray<char>(v); }
+
+			return PwgError.Success;
+		}
+	}
+}

ModernKeePassLib/Cryptography/PasswordGenerator/CustomPwGenerator.cs

@@ -0,0 +1,66 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Text;
+
+using ModernKeePassLib;
+using ModernKeePassLib.Security;
+
+namespace ModernKeePassLib.Cryptography.PasswordGenerator
+{
+	public abstract class CustomPwGenerator
+	{
+		/// <summary>
+		/// Each custom password generation algorithm must have
+		/// its own unique UUID.
+		/// </summary>
+		public abstract PwUuid Uuid { get; }
+
+		/// <summary>
+		/// Displayable name of the password generation algorithm.
+		/// </summary>
+		public abstract string Name { get; }
+
+		public virtual bool SupportsOptions
+		{
+			get { return false; }
+		}
+
+		/// <summary>
+		/// Password generation function.
+		/// </summary>
+		/// <param name="prf">Password generation options chosen
+		/// by the user. This may be <c>null</c>, if the default
+		/// options should be used.</param>
+		/// <param name="crsRandomSource">Source that the algorithm
+		/// can use to generate random numbers.</param>
+		/// <returns>Generated password or <c>null</c> in case
+		/// of failure. If returning <c>null</c>, the caller assumes
+		/// that an error message has already been shown to the user.</returns>
+		public abstract ProtectedString Generate(PwProfile prf,
+			CryptoRandomStream crsRandomSource);
+
+		public virtual string GetOptions(string strCurrentOptions)
+		{
+			return string.Empty;
+		}
+	}
+}

ModernKeePassLib/Cryptography/PasswordGenerator/CustomPwGeneratorPool.cs

@@ -0,0 +1,110 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.Text;
+
+namespace ModernKeePassLib.Cryptography.PasswordGenerator
+{
+	public sealed class CustomPwGeneratorPool : IEnumerable<CustomPwGenerator>
+	{
+		private List<CustomPwGenerator> m_vGens = new List<CustomPwGenerator>();
+
+		public int Count
+		{
+			get { return m_vGens.Count; }
+		}
+
+		public CustomPwGeneratorPool()
+		{
+		}
+
+		IEnumerator IEnumerable.GetEnumerator()
+		{
+			return m_vGens.GetEnumerator();
+		}
+
+		public IEnumerator<CustomPwGenerator> GetEnumerator()
+		{
+			return m_vGens.GetEnumerator();
+		}
+
+		public void Add(CustomPwGenerator pwg)
+		{
+			if(pwg == null) throw new ArgumentNullException("pwg");
+
+			PwUuid uuid = pwg.Uuid;
+			if(uuid == null) throw new ArgumentException();
+
+			int nIndex = FindIndex(uuid);
+
+			if(nIndex >= 0) m_vGens[nIndex] = pwg; // Replace
+			else m_vGens.Add(pwg);
+		}
+
+		public CustomPwGenerator Find(PwUuid uuid)
+		{
+			if(uuid == null) throw new ArgumentNullException("uuid");
+
+			foreach(CustomPwGenerator pwg in m_vGens)
+			{
+				if(uuid.Equals(pwg.Uuid)) return pwg;
+			}
+
+			return null;
+		}
+
+		public CustomPwGenerator Find(string strName)
+		{
+			if(strName == null) throw new ArgumentNullException("strName");
+
+			foreach(CustomPwGenerator pwg in m_vGens)
+			{
+				if(pwg.Name == strName) return pwg;
+			}
+
+			return null;
+		}
+
+		private int FindIndex(PwUuid uuid)
+		{
+			if(uuid == null) throw new ArgumentNullException("uuid");
+
+			for(int i = 0; i < m_vGens.Count; ++i)
+			{
+				if(uuid.Equals(m_vGens[i].Uuid)) return i;
+			}
+
+			return -1;
+		}
+
+		public bool Remove(PwUuid uuid)
+		{
+			if(uuid == null) throw new ArgumentNullException("uuid");
+
+			int nIndex = FindIndex(uuid);
+			if(nIndex < 0) return false;
+
+			m_vGens.RemoveAt(nIndex);
+			return true;
+		}
+	}
+}

ModernKeePassLib/Cryptography/PasswordGenerator/PatternBasedGenerator.cs

@@ -0,0 +1,187 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Text;
+
+using ModernKeePassLib.Security;
+using ModernKeePassLib.Utility;
+
+namespace ModernKeePassLib.Cryptography.PasswordGenerator
+{
+	internal static class PatternBasedGenerator
+	{
+		internal static PwgError Generate(out ProtectedString psOut,
+			PwProfile pwProfile, CryptoRandomStream crsRandomSource)
+		{
+			psOut = ProtectedString.Empty;
+
+			LinkedList<char> llGenerated = new LinkedList<char>();
+			PwCharSet pcsCurrent = new PwCharSet();
+			PwCharSet pcsCustom = new PwCharSet();
+			PwCharSet pcsUsed = new PwCharSet();
+			bool bInCharSetDef = false;
+
+			string strPattern = ExpandPattern(pwProfile.Pattern);
+			if(strPattern.Length == 0) return PwgError.Success;
+
+			CharStream csStream = new CharStream(strPattern);
+			char ch = csStream.ReadChar();
+
+			while(ch != char.MinValue)
+			{
+				pcsCurrent.Clear();
+
+				bool bGenerateChar = false;
+
+				if(ch == '\\')
+				{
+					ch = csStream.ReadChar();
+					if(ch == char.MinValue) // Backslash at the end
+					{
+						llGenerated.AddLast('\\');
+						break;
+					}
+
+					if(bInCharSetDef) pcsCustom.Add(ch);
+					else
+					{
+						llGenerated.AddLast(ch);
+						pcsUsed.Add(ch);
+					}
+				}
+				else if(ch == '^')
+				{
+					ch = csStream.ReadChar();
+					if(ch == char.MinValue) // ^ at the end
+					{
+						llGenerated.AddLast('^');
+						break;
+					}
+
+					if(bInCharSetDef) pcsCustom.Remove(ch);
+				}
+				else if(ch == '[')
+				{
+					pcsCustom.Clear();
+					bInCharSetDef = true;
+				}
+				else if(ch == ']')
+				{
+					pcsCurrent.Add(pcsCustom.ToString());
+
+					bInCharSetDef = false;
+					bGenerateChar = true;
+				}
+				else if(bInCharSetDef)
+				{
+					if(pcsCustom.AddCharSet(ch) == false)
+						pcsCustom.Add(ch);
+				}
+				else if(pcsCurrent.AddCharSet(ch) == false)
+				{
+					llGenerated.AddLast(ch);
+					pcsUsed.Add(ch);
+				}
+				else bGenerateChar = true;
+
+				if(bGenerateChar)
+				{
+					PwGenerator.PrepareCharSet(pcsCurrent, pwProfile);
+
+					if(pwProfile.NoRepeatingCharacters)
+						pcsCurrent.Remove(pcsUsed.ToString());
+
+					char chGen = PwGenerator.GenerateCharacter(pwProfile,
+						pcsCurrent, crsRandomSource);
+
+					if(chGen == char.MinValue) return PwgError.TooFewCharacters;
+
+					llGenerated.AddLast(chGen);
+					pcsUsed.Add(chGen);
+				}
+
+				ch = csStream.ReadChar();
+			}
+
+			if(llGenerated.Count == 0) return PwgError.Success;
+
+			char[] v = new char[llGenerated.Count];
+			llGenerated.CopyTo(v, 0);
+
+			if(pwProfile.PatternPermutePassword)
+				PwGenerator.Shuffle(v, crsRandomSource);
+
+			byte[] pbUtf8 = StrUtil.Utf8.GetBytes(v);
+			psOut = new ProtectedString(true, pbUtf8);
+			MemUtil.ZeroByteArray(pbUtf8);
+
+			MemUtil.ZeroArray<char>(v);
+			llGenerated.Clear();
+
+			return PwgError.Success;
+		}
+
+		private static string ExpandPattern(string strPattern)
+		{
+			if(strPattern == null) { Debug.Assert(false); return string.Empty; }
+
+			string str = strPattern;
+
+			while(true)
+			{
+				int nOpen = FindFirstUnescapedChar(str, '{');
+				int nClose = FindFirstUnescapedChar(str, '}');
+
+				if((nOpen >= 0) && (nOpen < nClose))
+				{
+					string strCount = str.Substring(nOpen + 1, nClose - nOpen - 1);
+					str = str.Remove(nOpen, nClose - nOpen + 1);
+
+					uint uRepeat;
+					if(StrUtil.TryParseUInt(strCount, out uRepeat) && (nOpen >= 1))
+					{
+						if(uRepeat == 0)
+							str = str.Remove(nOpen - 1, 1);
+						else
+							str = str.Insert(nOpen, new string(str[nOpen - 1], (int)uRepeat - 1));
+					}
+				}
+				else break;
+			}
+
+			return str;
+		}
+
+		private static int FindFirstUnescapedChar(string str, char ch)
+		{
+			for(int i = 0; i < str.Length; ++i)
+			{
+				char chCur = str[i];
+
+				if(chCur == '\\') ++i; // Next is escaped, skip it
+				else if(chCur == ch) return i;
+			}
+
+			return -1;
+		}
+	}
+}

ModernKeePassLib/Cryptography/PasswordGenerator/PwCharSet.cs

@@ -0,0 +1,351 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Text;
+
+namespace ModernKeePassLib.Cryptography.PasswordGenerator
+{
+	public sealed class PwCharSet
+	{
+		public static readonly string UpperCase = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
+		public static readonly string LowerCase = "abcdefghijklmnopqrstuvwxyz";
+		public static readonly string Digits = "0123456789";
+
+		public static readonly string UpperConsonants = "BCDFGHJKLMNPQRSTVWXYZ";
+		public static readonly string LowerConsonants = "bcdfghjklmnpqrstvwxyz";
+		public static readonly string UpperVowels = "AEIOU";
+		public static readonly string LowerVowels = "aeiou";
+
+		public static readonly string Punctuation = @",.;:";
+		public static readonly string Brackets = @"[]{}()<>";
+
+		public static readonly string PrintableAsciiSpecial = "!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~";
+
+		public static readonly string UpperHex = "0123456789ABCDEF";
+		public static readonly string LowerHex = "0123456789abcdef";
+
+		public static readonly string Invalid = "\t\r\n";
+		public static readonly string LookAlike = @"O0l1I|";
+
+		internal static readonly string MenuAccels = PwCharSet.LowerCase + PwCharSet.Digits;
+
+		private const int CharTabSize = 0x10000 / 8;
+
+		private List<char> m_vChars = new List<char>();
+		private byte[] m_vTab = new byte[CharTabSize];
+
+		private static string m_strHighAnsi = null;
+		public static string HighAnsiChars
+		{
+			get
+			{
+				if(m_strHighAnsi == null) { new PwCharSet(); } // Create string
+				Debug.Assert(m_strHighAnsi != null);
+				return m_strHighAnsi;
+			}
+		}
+
+		private static string m_strSpecial = null;
+		public static string SpecialChars
+		{
+			get
+			{
+				if(m_strSpecial == null) { new PwCharSet(); } // Create string
+				Debug.Assert(m_strSpecial != null);
+				return m_strSpecial;
+			}
+		}
+
+		/// <summary>
+		/// Create a new, empty character set collection object.
+		/// </summary>
+		public PwCharSet()
+		{
+			Initialize(true);
+		}
+
+		public PwCharSet(string strCharSet)
+		{
+			Initialize(true);
+			Add(strCharSet);
+		}
+
+		private PwCharSet(bool bFullInitialize)
+		{
+			Initialize(bFullInitialize);
+		}
+
+		private void Initialize(bool bFullInitialize)
+		{
+			Clear();
+
+			if(!bFullInitialize) return;
+
+			if(m_strHighAnsi == null)
+			{
+				StringBuilder sbHighAnsi = new StringBuilder();
+				// [U+0080, U+009F] are C1 control characters,
+				// U+00A0 is non-breaking space
+				for(char ch = '\u00A1'; ch <= '\u00AC'; ++ch)
+					sbHighAnsi.Append(ch);
+				// U+00AD is soft hyphen (format character)
+				for(char ch = '\u00AE'; ch < '\u00FF'; ++ch)
+					sbHighAnsi.Append(ch);
+				sbHighAnsi.Append('\u00FF');
+
+				m_strHighAnsi = sbHighAnsi.ToString();
+			}
+
+			if(m_strSpecial == null)
+			{
+				PwCharSet pcs = new PwCharSet(false);
+				pcs.AddRange('!', '/');
+				pcs.AddRange(':', '@');
+				pcs.AddRange('[', '`');
+				pcs.Add(@"|~");
+				pcs.Remove(@"-_ ");
+				pcs.Remove(PwCharSet.Brackets);
+
+				m_strSpecial = pcs.ToString();
+			}
+		}
+
+		/// <summary>
+		/// Number of characters in this set.
+		/// </summary>
+		public uint Size
+		{
+			get { return (uint)m_vChars.Count; }
+		}
+
+		/// <summary>
+		/// Get a character of the set using an index.
+		/// </summary>
+		/// <param name="uPos">Index of the character to get.</param>
+		/// <returns>Character at the specified position. If the index is invalid,
+		/// an <c>ArgumentOutOfRangeException</c> is thrown.</returns>
+		public char this[uint uPos]
+		{
+			get
+			{
+				if(uPos >= (uint)m_vChars.Count)
+					throw new ArgumentOutOfRangeException("uPos");
+
+				return m_vChars[(int)uPos];
+			}
+		}
+
+		/// <summary>
+		/// Remove all characters from this set.
+		/// </summary>
+		public void Clear()
+		{
+			m_vChars.Clear();
+			Array.Clear(m_vTab, 0, m_vTab.Length);
+		}
+
+		public bool Contains(char ch)
+		{
+			return (((m_vTab[ch / 8] >> (ch % 8)) & 1) != char.MinValue);
+		}
+
+		public bool Contains(string strCharacters)
+		{
+			Debug.Assert(strCharacters != null);
+			if(strCharacters == null) throw new ArgumentNullException("strCharacters");
+
+			foreach(char ch in strCharacters)
+			{
+				if(!Contains(ch)) return false;
+			}
+
+			return true;
+		}
+
+		/// <summary>
+		/// Add characters to the set.
+		/// </summary>
+		/// <param name="ch">Character to add.</param>
+		public void Add(char ch)
+		{
+			if(ch == char.MinValue) { Debug.Assert(false); return; }
+
+			if(!Contains(ch))
+			{
+				m_vChars.Add(ch);
+				m_vTab[ch / 8] |= (byte)(1 << (ch % 8));
+			}
+		}
+
+		/// <summary>
+		/// Add characters to the set.
+		/// </summary>
+		/// <param name="strCharSet">String containing characters to add.</param>
+		public void Add(string strCharSet)
+		{
+			Debug.Assert(strCharSet != null);
+			if(strCharSet == null) throw new ArgumentNullException("strCharSet");
+
+			m_vChars.Capacity = m_vChars.Count + strCharSet.Length;
+
+			foreach(char ch in strCharSet)
+				Add(ch);
+		}
+
+		public void Add(string strCharSet1, string strCharSet2)
+		{
+			Add(strCharSet1);
+			Add(strCharSet2);
+		}
+
+		public void Add(string strCharSet1, string strCharSet2, string strCharSet3)
+		{
+			Add(strCharSet1);
+			Add(strCharSet2);
+			Add(strCharSet3);
+		}
+
+		public void AddRange(char chMin, char chMax)
+		{
+			m_vChars.Capacity = m_vChars.Count + (chMax - chMin) + 1;
+
+			for(char ch = chMin; ch < chMax; ++ch)
+				Add(ch);
+
+			Add(chMax);
+		}
+
+		public bool AddCharSet(char chCharSetIdentifier)
+		{
+			bool bResult = true;
+
+			switch(chCharSetIdentifier)
+			{
+				case 'a': Add(PwCharSet.LowerCase, PwCharSet.Digits); break;
+				case 'A': Add(PwCharSet.LowerCase, PwCharSet.UpperCase,
+					PwCharSet.Digits); break;
+				case 'U': Add(PwCharSet.UpperCase, PwCharSet.Digits); break;
+				case 'c': Add(PwCharSet.LowerConsonants); break;
+				case 'C': Add(PwCharSet.LowerConsonants,
+					PwCharSet.UpperConsonants); break;
+				case 'z': Add(PwCharSet.UpperConsonants); break;
+				case 'd': Add(PwCharSet.Digits); break; // Digit
+				case 'h': Add(PwCharSet.LowerHex); break;
+				case 'H': Add(PwCharSet.UpperHex); break;
+				case 'l': Add(PwCharSet.LowerCase); break;
+				case 'L': Add(PwCharSet.LowerCase, PwCharSet.UpperCase); break;
+				case 'u': Add(PwCharSet.UpperCase); break;
+				case 'p': Add(PwCharSet.Punctuation); break;
+				case 'b': Add(PwCharSet.Brackets); break;
+				case 's': Add(PwCharSet.PrintableAsciiSpecial); break;
+				case 'S': Add(PwCharSet.UpperCase, PwCharSet.LowerCase);
+					Add(PwCharSet.Digits, PwCharSet.PrintableAsciiSpecial); break;
+				case 'v': Add(PwCharSet.LowerVowels); break;
+				case 'V': Add(PwCharSet.LowerVowels, PwCharSet.UpperVowels); break;
+				case 'Z': Add(PwCharSet.UpperVowels); break;
+				case 'x': Add(m_strHighAnsi); break;
+				default: bResult = false; break;
+			}
+
+			return bResult;
+		}
+
+		public bool Remove(char ch)
+		{
+			m_vTab[ch / 8] &= (byte)(~(1 << (ch % 8)));
+			return m_vChars.Remove(ch);
+		}
+
+		public bool Remove(string strCharacters)
+		{
+			Debug.Assert(strCharacters != null);
+			if(strCharacters == null) throw new ArgumentNullException("strCharacters");
+
+			bool bResult = true;
+			foreach(char ch in strCharacters)
+			{
+				if(!Remove(ch)) bResult = false;
+			}
+
+			return bResult;
+		}
+
+		public bool RemoveIfAllExist(string strCharacters)
+		{
+			Debug.Assert(strCharacters != null);
+			if(strCharacters == null) throw new ArgumentNullException("strCharacters");
+
+			if(!Contains(strCharacters))
+				return false;
+
+			return Remove(strCharacters);
+		}
+
+		/// <summary>
+		/// Convert the character set to a string containing all its characters.
+		/// </summary>
+		/// <returns>String containing all character set characters.</returns>
+		public override string ToString()
+		{
+			StringBuilder sb = new StringBuilder();
+			foreach(char ch in m_vChars)
+				sb.Append(ch);
+
+			return sb.ToString();
+		}
+
+		public string PackAndRemoveCharRanges()
+		{
+			StringBuilder sb = new StringBuilder();
+
+			sb.Append(RemoveIfAllExist(PwCharSet.UpperCase) ? 'U' : '_');
+			sb.Append(RemoveIfAllExist(PwCharSet.LowerCase) ? 'L' : '_');
+			sb.Append(RemoveIfAllExist(PwCharSet.Digits) ? 'D' : '_');
+			sb.Append(RemoveIfAllExist(m_strSpecial) ? 'S' : '_');
+			sb.Append(RemoveIfAllExist(PwCharSet.Punctuation) ? 'P' : '_');
+			sb.Append(RemoveIfAllExist(@"-") ? 'm' : '_');
+			sb.Append(RemoveIfAllExist(@"_") ? 'u' : '_');
+			sb.Append(RemoveIfAllExist(@" ") ? 's' : '_');
+			sb.Append(RemoveIfAllExist(PwCharSet.Brackets) ? 'B' : '_');
+			sb.Append(RemoveIfAllExist(m_strHighAnsi) ? 'H' : '_');
+
+			return sb.ToString();
+		}
+
+		public void UnpackCharRanges(string strRanges)
+		{
+			if(strRanges == null) { Debug.Assert(false); return; }
+			if(strRanges.Length < 10) { Debug.Assert(false); return; }
+
+			if(strRanges[0] != '_') Add(PwCharSet.UpperCase);
+			if(strRanges[1] != '_') Add(PwCharSet.LowerCase);
+			if(strRanges[2] != '_') Add(PwCharSet.Digits);
+			if(strRanges[3] != '_') Add(m_strSpecial);
+			if(strRanges[4] != '_') Add(PwCharSet.Punctuation);
+			if(strRanges[5] != '_') Add('-');
+			if(strRanges[6] != '_') Add('_');
+			if(strRanges[7] != '_') Add(' ');
+			if(strRanges[8] != '_') Add(PwCharSet.Brackets);
+			if(strRanges[9] != '_') Add(m_strHighAnsi);
+		}
+	}
+}

ModernKeePassLib/Cryptography/PasswordGenerator/PwGenerator.cs

@@ -0,0 +1,163 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Text;
+
+#if !KeePassUAP
+using System.Security.Cryptography;
+#endif
+
+using ModernKeePassLib.Security;
+using ModernKeePassLib.Utility;
+
+namespace ModernKeePassLib.Cryptography.PasswordGenerator
+{
+	public enum PwgError
+	{
+		Success = 0,
+		Unknown = 1,
+		TooFewCharacters = 2,
+		UnknownAlgorithm = 3
+	}
+
+	/// <summary>
+	/// Utility functions for generating random passwords.
+	/// </summary>
+	public static class PwGenerator
+	{
+		public static PwgError Generate(out ProtectedString psOut,
+			PwProfile pwProfile, byte[] pbUserEntropy,
+			CustomPwGeneratorPool pwAlgorithmPool)
+		{
+			Debug.Assert(pwProfile != null);
+			if(pwProfile == null) throw new ArgumentNullException("pwProfile");
+
+			PwgError e = PwgError.Unknown;
+			CryptoRandomStream crs = null;
+			byte[] pbKey = null;
+			try
+			{
+				crs = CreateRandomStream(pbUserEntropy, out pbKey);
+
+				if(pwProfile.GeneratorType == PasswordGeneratorType.CharSet)
+					e = CharSetBasedGenerator.Generate(out psOut, pwProfile, crs);
+				else if(pwProfile.GeneratorType == PasswordGeneratorType.Pattern)
+					e = PatternBasedGenerator.Generate(out psOut, pwProfile, crs);
+				else if(pwProfile.GeneratorType == PasswordGeneratorType.Custom)
+					e = GenerateCustom(out psOut, pwProfile, crs, pwAlgorithmPool);
+				else { Debug.Assert(false); psOut = ProtectedString.Empty; }
+			}
+			finally
+			{
+				if(crs != null) crs.Dispose();
+				if(pbKey != null) MemUtil.ZeroByteArray(pbKey);
+			}
+
+			return e;
+		}
+
+		private static CryptoRandomStream CreateRandomStream(byte[] pbAdditionalEntropy,
+			out byte[] pbKey)
+		{
+			pbKey = CryptoRandom.Instance.GetRandomBytes(128);
+
+			// Mix in additional entropy
+			Debug.Assert(pbKey.Length >= 64);
+			if((pbAdditionalEntropy != null) && (pbAdditionalEntropy.Length > 0))
+			{
+				using(SHA512Managed h = new SHA512Managed())
+				{
+					byte[] pbHash = h.ComputeHash(pbAdditionalEntropy);
+					MemUtil.XorArray(pbHash, 0, pbKey, 0, pbHash.Length);
+				}
+			}
+
+			return new CryptoRandomStream(CrsAlgorithm.ChaCha20, pbKey);
+		}
+
+		internal static char GenerateCharacter(PwProfile pwProfile,
+			PwCharSet pwCharSet, CryptoRandomStream crsRandomSource)
+		{
+			if(pwCharSet.Size == 0) return char.MinValue;
+
+			ulong uIndex = crsRandomSource.GetRandomUInt64();
+			uIndex %= (ulong)pwCharSet.Size;
+
+			char ch = pwCharSet[(uint)uIndex];
+
+			if(pwProfile.NoRepeatingCharacters)
+				pwCharSet.Remove(ch);
+
+			return ch;
+		}
+
+		internal static void PrepareCharSet(PwCharSet pwCharSet, PwProfile pwProfile)
+		{
+			pwCharSet.Remove(PwCharSet.Invalid);
+
+			if(pwProfile.ExcludeLookAlike) pwCharSet.Remove(PwCharSet.LookAlike);
+
+			if(pwProfile.ExcludeCharacters.Length > 0)
+				pwCharSet.Remove(pwProfile.ExcludeCharacters);
+		}
+
+		internal static void Shuffle(char[] v, CryptoRandomStream crsRandomSource)
+		{
+			if(v == null) { Debug.Assert(false); return; }
+			if(crsRandomSource == null) { Debug.Assert(false); return; }
+
+			for(int i = v.Length - 1; i >= 1; --i)
+			{
+				ulong r = crsRandomSource.GetRandomUInt64();
+				int j = (int)(r % (ulong)(i + 1));
+
+				char t = v[i];
+				v[i] = v[j];
+				v[j] = t;
+			}
+		}
+
+		private static PwgError GenerateCustom(out ProtectedString psOut,
+			PwProfile pwProfile, CryptoRandomStream crs,
+			CustomPwGeneratorPool pwAlgorithmPool)
+		{
+			psOut = ProtectedString.Empty;
+
+			Debug.Assert(pwProfile.GeneratorType == PasswordGeneratorType.Custom);
+			if(pwAlgorithmPool == null) return PwgError.UnknownAlgorithm;
+
+			string strID = pwProfile.CustomAlgorithmUuid;
+			if(string.IsNullOrEmpty(strID)) return PwgError.UnknownAlgorithm;
+
+			byte[] pbUuid = Convert.FromBase64String(strID);
+			PwUuid uuid = new PwUuid(pbUuid);
+			CustomPwGenerator pwg = pwAlgorithmPool.Find(uuid);
+			if(pwg == null) { Debug.Assert(false); return PwgError.UnknownAlgorithm; }
+
+			ProtectedString pwd = pwg.Generate(pwProfile.CloneDeep(), crs);
+			if(pwd == null) return PwgError.Unknown;
+
+			psOut = pwd;
+			return PwgError.Success;
+		}
+	}
+}

ModernKeePassLib/Cryptography/PasswordGenerator/PwProfile.cs

@@ -0,0 +1,276 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Text;
+using System.Xml.Serialization;
+using System.ComponentModel;
+using System.Diagnostics;
+
+using ModernKeePassLib.Interfaces;
+using ModernKeePassLib.Security;
+using ModernKeePassLib.Utility;
+
+namespace ModernKeePassLib.Cryptography.PasswordGenerator
+{
+	/// <summary>
+	/// Type of the password generator. Different types like generators
+	/// based on given patterns, based on character sets, etc. are
+	/// available.
+	/// </summary>
+	public enum PasswordGeneratorType
+	{
+		/// <summary>
+		/// Generator based on character spaces/sets, i.e. groups
+		/// of characters like lower-case, upper-case or numeric characters.
+		/// </summary>
+		CharSet = 0,
+
+		/// <summary>
+		/// Password generation based on a pattern. The user has provided
+		/// a pattern, which describes how the generated password has to
+		/// look like.
+		/// </summary>
+		Pattern = 1,
+
+		Custom = 2
+	}
+
+	public sealed class PwProfile : IDeepCloneable<PwProfile>
+	{
+		private string m_strName = string.Empty;
+		[DefaultValue("")]
+		public string Name
+		{
+			get { return m_strName; }
+			set { m_strName = value; }
+		}
+
+		private PasswordGeneratorType m_type = PasswordGeneratorType.CharSet;
+		public PasswordGeneratorType GeneratorType
+		{
+			get { return m_type; }
+			set { m_type = value; }
+		}
+
+		private bool m_bUserEntropy = false;
+		[DefaultValue(false)]
+		public bool CollectUserEntropy
+		{
+			get { return m_bUserEntropy; }
+			set { m_bUserEntropy = value; }
+		}
+
+		private uint m_uLength = 20;
+		public uint Length
+		{
+			get { return m_uLength; }
+			set { m_uLength = value; }
+		}
+
+		private PwCharSet m_pwCharSet = new PwCharSet(PwCharSet.UpperCase +
+			PwCharSet.LowerCase + PwCharSet.Digits);
+		[XmlIgnore]
+		public PwCharSet CharSet
+		{
+			get { return m_pwCharSet; }
+			set
+			{
+				if(value == null) throw new ArgumentNullException("value");
+				m_pwCharSet = value;
+			}
+		}
+
+		private string m_strCharSetRanges = string.Empty;
+		[DefaultValue("")]
+		public string CharSetRanges
+		{
+			get { this.UpdateCharSet(true); return m_strCharSetRanges; }
+			set
+			{
+				if(value == null) throw new ArgumentNullException("value");
+				m_strCharSetRanges = value;
+				this.UpdateCharSet(false);
+			}
+		}
+
+		private string m_strCharSetAdditional = string.Empty;
+		[DefaultValue("")]
+		public string CharSetAdditional
+		{
+			get { this.UpdateCharSet(true); return m_strCharSetAdditional; }
+			set
+			{
+				if(value == null) throw new ArgumentNullException("value");
+				m_strCharSetAdditional = value;
+				this.UpdateCharSet(false);
+			}
+		}
+
+		private string m_strPattern = string.Empty;
+		[DefaultValue("")]
+		public string Pattern
+		{
+			get { return m_strPattern; }
+			set { m_strPattern = value; }
+		}
+
+		private bool m_bPatternPermute = false;
+		[DefaultValue(false)]
+		public bool PatternPermutePassword
+		{
+			get { return m_bPatternPermute; }
+			set { m_bPatternPermute = value; }
+		}
+
+		private bool m_bNoLookAlike = false;
+		[DefaultValue(false)]
+		public bool ExcludeLookAlike
+		{
+			get { return m_bNoLookAlike; }
+			set { m_bNoLookAlike = value; }
+		}
+
+		private bool m_bNoRepeat = false;
+		[DefaultValue(false)]
+		public bool NoRepeatingCharacters
+		{
+			get { return m_bNoRepeat; }
+			set { m_bNoRepeat = value; }
+		}
+
+		private string m_strExclude = string.Empty;
+		[DefaultValue("")]
+		public string ExcludeCharacters
+		{
+			get { return m_strExclude; }
+			set
+			{
+				if(value == null) throw new ArgumentNullException("value");
+				m_strExclude = value;
+			}
+		}
+
+		private string m_strCustomID = string.Empty;
+		[DefaultValue("")]
+		public string CustomAlgorithmUuid
+		{
+			get { return m_strCustomID; }
+			set
+			{
+				if(value == null) throw new ArgumentNullException("value");
+				m_strCustomID = value;
+			}
+		}
+
+		private string m_strCustomOpt = string.Empty;
+		[DefaultValue("")]
+		public string CustomAlgorithmOptions
+		{
+			get { return m_strCustomOpt; }
+			set
+			{
+				if(value == null) throw new ArgumentNullException("value");
+				m_strCustomOpt = value;
+			}
+		}
+
+		public PwProfile()
+		{
+		}
+
+		public PwProfile CloneDeep()
+		{
+			PwProfile p = new PwProfile();
+
+			p.m_strName = m_strName;
+			p.m_type = m_type;
+			p.m_bUserEntropy = m_bUserEntropy;
+			p.m_uLength = m_uLength;
+			p.m_pwCharSet = new PwCharSet(m_pwCharSet.ToString());
+			p.m_strCharSetRanges = m_strCharSetRanges;
+			p.m_strCharSetAdditional = m_strCharSetAdditional;
+			p.m_strPattern = m_strPattern;
+			p.m_bPatternPermute = m_bPatternPermute;
+			p.m_bNoLookAlike = m_bNoLookAlike;
+			p.m_bNoRepeat = m_bNoRepeat;
+			p.m_strExclude = m_strExclude;
+			p.m_strCustomID = m_strCustomID;
+			p.m_strCustomOpt = m_strCustomOpt;
+
+			return p;
+		}
+
+		private void UpdateCharSet(bool bSetXml)
+		{
+			if(bSetXml)
+			{
+				PwCharSet pcs = new PwCharSet(m_pwCharSet.ToString());
+				m_strCharSetRanges = pcs.PackAndRemoveCharRanges();
+				m_strCharSetAdditional = pcs.ToString();
+			}
+			else
+			{
+				PwCharSet pcs = new PwCharSet(m_strCharSetAdditional);
+				pcs.UnpackCharRanges(m_strCharSetRanges);
+				m_pwCharSet = pcs;
+			}
+		}
+
+		public static PwProfile DeriveFromPassword(ProtectedString psPassword)
+		{
+			PwProfile pp = new PwProfile();
+			Debug.Assert(psPassword != null); if(psPassword == null) return pp;
+
+			char[] vChars = psPassword.ReadChars();
+
+			pp.GeneratorType = PasswordGeneratorType.CharSet;
+			pp.Length = (uint)vChars.Length;
+
+			PwCharSet pcs = pp.CharSet;
+			pcs.Clear();
+
+			foreach(char ch in vChars)
+			{
+				if((ch >= 'A') && (ch <= 'Z')) pcs.Add(PwCharSet.UpperCase);
+				else if((ch >= 'a') && (ch <= 'z')) pcs.Add(PwCharSet.LowerCase);
+				else if((ch >= '0') && (ch <= '9')) pcs.Add(PwCharSet.Digits);
+				else if(PwCharSet.SpecialChars.IndexOf(ch) >= 0)
+					pcs.Add(PwCharSet.SpecialChars);
+				else if(ch == ' ') pcs.Add(' ');
+				else if(ch == '-') pcs.Add('-');
+				else if(ch == '_') pcs.Add('_');
+				else if(PwCharSet.Brackets.IndexOf(ch) >= 0)
+					pcs.Add(PwCharSet.Brackets);
+				else if(PwCharSet.HighAnsiChars.IndexOf(ch) >= 0)
+					pcs.Add(PwCharSet.HighAnsiChars);
+				else pcs.Add(ch);
+			}
+
+			MemUtil.ZeroArray<char>(vChars);
+			return pp;
+		}
+
+		public bool HasSecurityReducingOption()
+		{
+			return (m_bNoLookAlike || m_bNoRepeat || (m_strExclude.Length > 0));
+		}
+	}
+}

ModernKeePassLib/Cryptography/PopularPasswords.cs

@@ -0,0 +1,133 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Text;
+
+using ModernKeePassLib.Utility;
+
+namespace ModernKeePassLib.Cryptography
+{
+	public static class PopularPasswords
+	{
+		private static Dictionary<int, Dictionary<char[], bool>> m_dicts =
+			new Dictionary<int, Dictionary<char[], bool>>();
+
+		internal static int MaxLength
+		{
+			get
+			{
+				Debug.Assert(m_dicts.Count > 0); // Should be initialized
+
+				int iMaxLen = 0;
+				foreach(int iLen in m_dicts.Keys)
+				{
+					if(iLen > iMaxLen) iMaxLen = iLen;
+				}
+
+				return iMaxLen;
+			}
+		}
+
+		internal static bool ContainsLength(int nLength)
+		{
+			Dictionary<char[], bool> dDummy;
+			return m_dicts.TryGetValue(nLength, out dDummy);
+		}
+
+		public static bool IsPopularPassword(char[] vPassword)
+		{
+			ulong uDummy;
+			return IsPopularPassword(vPassword, out uDummy);
+		}
+
+		public static bool IsPopularPassword(char[] vPassword, out ulong uDictSize)
+		{
+			if(vPassword == null) throw new ArgumentNullException("vPassword");
+			if(vPassword.Length == 0) { uDictSize = 0; return false; }
+
+#if DEBUG
+			Array.ForEach(vPassword, ch => Debug.Assert(ch == char.ToLower(ch)));
+#endif
+
+			try { return IsPopularPasswordPriv(vPassword, out uDictSize); }
+			catch(Exception) { Debug.Assert(false); }
+
+			uDictSize = 0;
+			return false;
+		}
+
+		private static bool IsPopularPasswordPriv(char[] vPassword, out ulong uDictSize)
+		{
+			Debug.Assert(m_dicts.Count > 0); // Should be initialized with data
+
+			Dictionary<char[], bool> d;
+			if(!m_dicts.TryGetValue(vPassword.Length, out d))
+			{
+				uDictSize = 0;
+				return false;
+			}
+
+			uDictSize = (ulong)d.Count;
+			return d.ContainsKey(vPassword);
+		}
+
+		public static void Add(byte[] pbData, bool bGZipped)
+		{
+			try
+			{
+				if(bGZipped)
+					pbData = MemUtil.Decompress(pbData);
+
+				string strData = StrUtil.Utf8.GetString(pbData, 0, pbData.Length);
+				if(string.IsNullOrEmpty(strData)) { Debug.Assert(false); return; }
+
+				StringBuilder sb = new StringBuilder();
+				for(int i = 0; i <= strData.Length; ++i)
+				{
+					char ch = ((i == strData.Length) ? ' ' : strData[i]);
+
+					if(char.IsWhiteSpace(ch))
+					{
+						int cc = sb.Length;
+						if(cc > 0)
+						{
+							char[] vWord = new char[cc];
+							sb.CopyTo(0, vWord, 0, cc);
+
+							Dictionary<char[], bool> d;
+							if(!m_dicts.TryGetValue(cc, out d))
+							{
+								d = new Dictionary<char[], bool>(MemUtil.ArrayHelperExOfChar);
+								m_dicts[cc] = d;
+							}
+
+							d[vWord] = true;
+							sb.Remove(0, cc);
+						}
+					}
+					else sb.Append(char.ToLower(ch));
+				}
+			}
+			catch(Exception) { Debug.Assert(false); }
+		}
+	}
+}

ModernKeePassLib/Cryptography/ProtectedData.cs

@@ -0,0 +1,19 @@
+using System;
+using System.Security.Cryptography;
+using ModernKeePassLib.Native;
+
+namespace ModernKeePassLib.Cryptography
+{
+    public static class ProtectedData
+    {
+        public static byte[] Unprotect(byte[] pbEnc, byte[] mPbOptEnt, DataProtectionScope currentUser)
+        {
+            throw new NotImplementedException();
+        }
+
+        public static byte[] Protect(byte[] pbPlain, byte[] mPbOptEnt, DataProtectionScope currentUser)
+        {
+            throw new NotImplementedException();
+        }
+    }
+}

ModernKeePassLib/Cryptography/QualityEstimation.cs

@@ -0,0 +1,779 @@
+/*
+  KeePass Password Safe - The Open-Source Password Manager
+  Copyright (C) 2003-2019 Dominik Reichl <dominik.reichl@t-online.de>
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Text;
+
+using ModernKeePassLib.Cryptography.PasswordGenerator;
+using ModernKeePassLib.Utility;
+
+namespace ModernKeePassLib.Cryptography
+{
+	/// <summary>
+	/// A class that offers static functions to estimate the quality of
+	/// passwords.
+	/// </summary>
+	public static class QualityEstimation
+	{
+		private static class PatternID
+		{
+			internal const char LowerAlpha = 'L';
+			internal const char UpperAlpha = 'U';
+			internal const char Digit = 'D';
+			internal const char Special = 'S';
+			internal const char High = 'H';
+			internal const char Other = 'X';
+
+			internal const char Dictionary = 'W';
+			internal const char Repetition = 'R';
+			internal const char Number = 'N';
+			internal const char DiffSeq = 'C';
+
+			internal const string All = "LUDSHXWRNC";
+		}
+
+		// private static class CharDistrib
+		// {
+		//	public static readonly ulong[] LowerAlpha = new ulong[26] {
+		//		884, 211, 262, 249, 722, 98, 172, 234, 556, 124, 201, 447, 321,
+		//		483, 518, 167, 18, 458, 416, 344, 231, 105, 80, 48, 238, 76
+		//	};
+		//	public static readonly ulong[] UpperAlpha = new ulong[26] {
+		//		605, 188, 209, 200, 460, 81, 130, 163, 357, 122, 144, 332, 260,
+		//		317, 330, 132, 18, 320, 315, 250, 137, 76, 60, 36, 161, 54
+		//	};
+		//	public static readonly ulong[] Digit = new ulong[10] {
+		//		574, 673, 524, 377, 339, 336, 312, 310, 357, 386
+		//	};
+		// }
+
+		private sealed class QeCharType
+		{
+			private readonly char m_chTypeID;
+			public char TypeID { get { return m_chTypeID; } }
+
+			private readonly string m_strAlph;
+			public string Alphabet { get { return m_strAlph; } }
+
+			private readonly int m_nChars;
+			public int CharCount { get { return m_nChars; } }
+
+			private readonly char m_chFirst;
+			private readonly char m_chLast;
+
+			private readonly double m_dblCharSize;
+			public double CharSize { get { return m_dblCharSize; } }
+
+			public QeCharType(char chTypeID, string strAlphabet, bool bIsConsecutive)
+			{
+				if(strAlphabet == null) throw new ArgumentNullException();
+				if(strAlphabet.Length == 0) throw new ArgumentException();
+
+				m_chTypeID = chTypeID;
+				m_strAlph = strAlphabet;
+				m_nChars = m_strAlph.Length;
+				m_chFirst = (bIsConsecutive ? m_strAlph[0] : char.MinValue);
+				m_chLast = (bIsConsecutive ? m_strAlph[m_nChars - 1] : char.MinValue);
+
+				m_dblCharSize = Log2(m_nChars);
+
+				Debug.Assert(((int)(m_chLast - m_chFirst) == (m_nChars - 1)) ||
+					!bIsConsecutive);
+			}
+
+			public QeCharType(char chTypeID, int nChars) // Catch-none set
+			{
+				if(nChars <= 0) throw new ArgumentOutOfRangeException();
+
+				m_chTypeID = chTypeID;
+				m_strAlph = string.Empty;
+				m_nChars = nChars;
+				m_chFirst = char.MinValue;
+				m_chLast = char.MinValue;
+
+				m_dblCharSize = Log2(m_nChars);
+			}
+
+			public bool Contains(char ch)
+			{
+				if(m_chLast != char.MinValue)
+					return ((ch >= m_chFirst) && (ch <= m_chLast));
+
+				Debug.Assert(m_strAlph.Length > 0); // Don't call for catch-none set
+				return (m_strAlph.IndexOf(ch) >= 0);
+			}
+		}
+
+		private sealed class EntropyEncoder
+		{
+			private readonly string m_strAlph;
+			private Dictionary<char, ulong> m_dHisto = new Dictionary<char, ulong>();
+			private readonly ulong m_uBaseWeight;
+			private readonly ulong m_uCharWeight;
+			private readonly ulong m_uOccExclThreshold;
+
+			public EntropyEncoder(string strAlphabet, ulong uBaseWeight,
+				ulong uCharWeight, ulong uOccExclThreshold)
+			{
+				if(strAlphabet == null) throw new ArgumentNullException();
+				if(strAlphabet.Length == 0) throw new ArgumentException();
+
+				m_strAlph = strAlphabet;
+				m_uBaseWeight = uBaseWeight;
+				m_uCharWeight = uCharWeight;
+				m_uOccExclThreshold = uOccExclThreshold;
+
+#if DEBUG
+				Dictionary<char, bool> d = new Dictionary<char, bool>();
+				foreach(char ch in m_strAlph) { d[ch] = true; }
+				Debug.Assert(d.Count == m_strAlph.Length); // No duplicates
+#endif
+			}
+
+			public void Reset()
+			{
+				m_dHisto.Clear();
+			}
+
+			public void Write(char ch)
+			{
+				Debug.Assert(m_strAlph.IndexOf(ch) >= 0);
+
+				ulong uOcc;
+				m_dHisto.TryGetValue(ch, out uOcc);
+				Debug.Assert(m_dHisto.ContainsKey(ch) || (uOcc == 0));
+				m_dHisto[ch] = uOcc + 1;
+			}
+
+			public double GetOutputSize()
+			{
+				ulong uTotalWeight = m_uBaseWeight * (ulong)m_strAlph.Length;
+				foreach(ulong u in m_dHisto.Values)
+				{
+					Debug.Assert(u >= 1);
+					if(u > m_uOccExclThreshold)
+						uTotalWeight += (u - m_uOccExclThreshold) * m_uCharWeight;
+				}
+
+				double dSize = 0.0, dTotalWeight = (double)uTotalWeight;
+				foreach(ulong u in m_dHisto.Values)
+				{
+					ulong uWeight = m_uBaseWeight;
+					if(u > m_uOccExclThreshold)
+						uWeight += (u - m_uOccExclThreshold) * m_uCharWeight;
+
+					dSize -= (double)u * Log2((double)uWeight / dTotalWeight);
+				}
+
+				return dSize;
+			}
+		}
+
+		private sealed class MultiEntropyEncoder
+		{
+			private Dictionary<char, EntropyEncoder> m_dEncs =
+				new Dictionary<char, EntropyEncoder>();
+
+			public MultiEntropyEncoder()
+			{
+			}
+
+			public void AddEncoder(char chTypeID, EntropyEncoder ec)
+			{
+				if(ec == null) { Debug.Assert(false); return; }
+
+				Debug.Assert(!m_dEncs.ContainsKey(chTypeID));
+				m_dEncs[chTypeID] = ec;
+			}
+
+			public void Reset()
+			{
+				foreach(EntropyEncoder ec in m_dEncs.Values) { ec.Reset(); }
+			}
+
+			public bool Write(char chTypeID, char chData)
+			{
+				EntropyEncoder ec;
+				if(!m_dEncs.TryGetValue(chTypeID, out ec))
+					return false;
+
+				ec.Write(chData);
+				return true;
+			}
+
+			public double GetOutputSize()
+			{
+				double d = 0.0;
+
+				foreach(EntropyEncoder ec in m_dEncs.Values)
+				{
+					d += ec.GetOutputSize();
+				}
+
+				return d;
+			}
+		}
+
+		private sealed class QePatternInstance
+		{
+			private readonly int m_iPos;
+			public int Position { get { return m_iPos; } }
+
+			private readonly int m_nLen;
+			public int Length { get { return m_nLen; } }
+
+			private readonly char m_chPatternID;
+			public char PatternID { get { return m_chPatternID; } }
+
+			private readonly double m_dblCost;
+			public double Cost { get { return m_dblCost; } }
+
+			private readonly QeCharType m_ctSingle;
+			public QeCharType SingleCharType { get { return m_ctSingle; } }
+
+			public QePatternInstance(int iPosition, int nLength, char chPatternID,
+				double dblCost)
+			{
+				m_iPos = iPosition;
+				m_nLen = nLength;
+				m_chPatternID = chPatternID;
+				m_dblCost = dblCost;
+				m_ctSingle = null;
+			}
+
+			public QePatternInstance(int iPosition, int nLength, QeCharType ctSingle)
+			{
+				m_iPos = iPosition;
+				m_nLen = nLength;
+				m_chPatternID = ctSingle.TypeID;
+				m_dblCost = ctSingle.CharSize;
+				m_ctSingle = ctSingle;
+			}
+		}
+
+		private sealed class QePathState
+		{
+			public readonly int Position;
+			public readonly List<QePatternInstance> Path;
+
+			public QePathState(int iPosition, List<QePatternInstance> lPath)
+			{
+				this.Position = iPosition;
+				this.Path = lPath;
+			}
+		}
+
+		private static readonly object m_objSyncInit = new object();
+		private static List<QeCharType> m_lCharTypes = null;
+
+		private static void EnsureInitialized()
+		{
+			lock(m_objSyncInit)
+			{
+				if(m_lCharTypes == null)
+				{
+					string strSpecial = PwCharSet.PrintableAsciiSpecial;
+					if(strSpecial.IndexOf(' ') >= 0) { Debug.Assert(false); }
+					else strSpecial = strSpecial + " ";
+
+					int nSp = strSpecial.Length;
+					int nHi = PwCharSet.HighAnsiChars.Length;
+
+					m_lCharTypes = new List<QeCharType>();
+
+					m_lCharTypes.Add(new QeCharType(PatternID.LowerAlpha,
+						PwCharSet.LowerCase, true));
+					m_lCharTypes.Add(new QeCharType(PatternID.UpperAlpha,
+						PwCharSet.UpperCase, true));
+					m_lCharTypes.Add(new QeCharType(PatternID.Digit,
+						PwCharSet.Digits, true));
+					m_lCharTypes.Add(new QeCharType(PatternID.Special,
+						strSpecial, false));
+					m_lCharTypes.Add(new QeCharType(PatternID.High,
+						PwCharSet.HighAnsiChars, false));
+					m_lCharTypes.Add(new QeCharType(PatternID.Other,
+						0x10000 - (2 * 26) - 10 - nSp - nHi));
+				}
+			}
+		}
+
+		/// <summary>
+		/// Estimate the quality of a password.
+		/// </summary>
+		/// <param name="vPassword">Password to check.</param>
+		/// <returns>Estimated bit-strength of the password.</returns>
+		public static uint EstimatePasswordBits(char[] vPassword)
+		{
+			if(vPassword == null) { Debug.Assert(false); return 0; }
+			if(vPassword.Length == 0) return 0;
+
+			EnsureInitialized();
+
+			int n = vPassword.Length;
+			List<QePatternInstance>[] vPatterns = new List<QePatternInstance>[n];
+			for(int i = 0; i < n; ++i)
+			{
+				vPatterns[i] = new List<QePatternInstance>();
+
+				QePatternInstance piChar = new QePatternInstance(i, 1,
+					GetCharType(vPassword[i]));
+				vPatterns[i].Add(piChar);
+			}
+
+			FindRepetitions(vPassword, vPatterns);
+			FindNumbers(vPassword, vPatterns);
+			FindDiffSeqs(vPassword, vPatterns);
+			FindPopularPasswords(vPassword, vPatterns);
+
+			// Encoders must not be static, because the entropy estimation
+			// may run concurrently in multiple threads and the encoders are
+			// not read-only
+			EntropyEncoder ecPattern = new EntropyEncoder(PatternID.All, 0, 1, 0);
+			MultiEntropyEncoder mcData = new MultiEntropyEncoder();
+			for(int i = 0; i < (m_lCharTypes.Count - 1); ++i)
+			{
+				// Let m be the alphabet size. In order to ensure that two same
+				// characters cost at least as much as a single character, for
+				// the probability p and weight w of the character it must hold:
+				//     -log(1/m) >= -2*log(p)
+				// <=> log(1/m) <= log(p^2) <=> 1/m <= p^2 <=> p >= sqrt(1/m);
+				//     sqrt(1/m) = (1+w)/(m+w)
+				// <=> m+w = (1+w)*sqrt(m) <=> m+w = sqrt(m) + w*sqrt(m)
+				// <=> w*(1-sqrt(m)) = sqrt(m) - m <=> w = (sqrt(m)-m)/(1-sqrt(m))
+				// <=> w = (sqrt(m)-m)*(1+sqrt(m))/(1-m)
+				// <=> w = (sqrt(m)-m+m-m*sqrt(m))/(1-m) <=> w = sqrt(m)
+				ulong uw = (ulong)Math.Sqrt((double)m_lCharTypes[i].CharCount);
+
+				mcData.AddEncoder(m_lCharTypes[i].TypeID, new EntropyEncoder(
+					m_lCharTypes[i].Alphabet, 1, uw, 1));
+			}
+
+			double dblMinCost = (double)int.MaxValue;
+			int tStart = Environment.TickCount;
+
+			Stack<QePathState> sRec = new Stack<QePathState>();
+			sRec.Push(new QePathState(0, new List<QePatternInstance>()));
+			while(sRec.Count > 0)
+			{
+				int tDiff = Environment.TickCount - tStart;
+				if(tDiff > 500) break;
+
+				QePathState s = sRec.Pop();
+
+				if(s.Position >= n)
+				{
+					Debug.Assert(s.Position == n);
+
+					double dblCost = ComputePathCost(s.Path, vPassword,
+						ecPattern, mcData);
+					if(dblCost < dblMinCost) dblMinCost = dblCost;
+				}
+				else
+				{
+					List<QePatternInstance> lSubs = vPatterns[s.Position];
+					for(int i = lSubs.Count - 1; i >= 0; --i)
+					{
+						QePatternInstance pi = lSubs[i];
+						Debug.Assert(pi.Position == s.Position);
+						Debug.Assert(pi.Length >= 1);
+
+						List<QePatternInstance> lNewPath =
+							new List<QePatternInstance>(s.Path.Count + 1);
+						lNewPath.AddRange(s.Path);
+						lNewPath.Add(pi);
+						Debug.Assert(lNewPath.Capacity == (s.Path.Count + 1));
+
+						QePathState sNew = new QePathState(s.Position +
+							pi.Length, lNewPath);
+						sRec.Push(sNew);
+					}
+				}
+			}
+
+			return (uint)Math.Ceiling(dblMinCost);
+		}
+
+		/// <summary>
+		/// Estimate the quality of a password.
+		/// </summary>
+		/// <param name="pbUnprotectedUtf8">Password to check, UTF-8 encoded.</param>
+		/// <returns>Estimated bit-strength of the password.</returns>
+		public static uint EstimatePasswordBits(byte[] pbUnprotectedUtf8)
+		{
+			if(pbUnprotectedUtf8 == null) { Debug.Assert(false); return 0; }
+
+			char[] v = StrUtil.Utf8.GetChars(pbUnprotectedUtf8);
+			uint r;
+			try { r = EstimatePasswordBits(v); }
+			finally { MemUtil.ZeroArray<char>(v); }
+
+			return r;
+		}
+
+		private static QeCharType GetCharType(char ch)
+		{
+			int nTypes = m_lCharTypes.Count;
+			Debug.Assert((nTypes > 0) && (m_lCharTypes[nTypes - 1].CharCount > 256));
+
+			for(int i = 0; i < (nTypes - 1); ++i)
+			{
+				if(m_lCharTypes[i].Contains(ch))
+					return m_lCharTypes[i];
+			}
+
+			return m_lCharTypes[nTypes - 1];
+		}
+
+		private static double ComputePathCost(List<QePatternInstance> l,
+			char[] vPassword, EntropyEncoder ecPattern, MultiEntropyEncoder mcData)
+		{
+			ecPattern.Reset();
+			for(int i = 0; i < l.Count; ++i)
+				ecPattern.Write(l[i].PatternID);
+			double dblPatternCost = ecPattern.GetOutputSize();
+
+			mcData.Reset();
+			double dblDataCost = 0.0;
+			foreach(QePatternInstance pi in l)
+			{
+				QeCharType tChar = pi.SingleCharType;
+				if(tChar != null)
+				{
+					char ch = vPassword[pi.Position];
+					if(!mcData.Write(tChar.TypeID, ch))
+						dblDataCost += pi.Cost;
+				}
+				else dblDataCost += pi.Cost;
+			}
+			dblDataCost += mcData.GetOutputSize();
+
+			return (dblPatternCost + dblDataCost);
+		}
+
+		private static void FindPopularPasswords(char[] vPassword,
+			List<QePatternInstance>[] vPatterns)
+		{
+			int n = vPassword.Length;
+
+			char[] vLower = new char[n];
+			char[] vLeet = new char[n];
+			for(int i = 0; i < n; ++i)
+			{
+				char ch = vPassword[i];
+
+				vLower[i] = char.ToLower(ch);
+				vLeet[i] = char.ToLower(DecodeLeetChar(ch));
+			}
+
+			char chErased = default(char); // The value that Array.Clear uses
+			Debug.Assert(chErased == char.MinValue);
+
+			int nMaxLen = Math.Min(n, PopularPasswords.MaxLength);
+			for(int nSubLen = nMaxLen; nSubLen >= 3; --nSubLen)
+			{
+				if(!PopularPasswords.ContainsLength(nSubLen)) continue;
+
+				char[] vSub = new char[nSubLen];
+
+				for(int i = 0; i <= (n - nSubLen); ++i)
+				{
+					if(Array.IndexOf<char>(vLower, chErased, i, nSubLen) >= 0)
+						continue;
+
+					Array.Copy(vLower, i, vSub, 0, nSubLen);
+					if(!EvalAddPopularPasswordPattern(vPatterns, vPassword,
+						i, vSub, 0.0))
+					{
+						Array.Copy(vLeet, i, vSub, 0, nSubLen);
+						if(EvalAddPopularPasswordPattern(vPatterns, vPassword,
+							i, vSub, 1.5))
+						{
+							Array.Clear(vLower, i, nSubLen); // Not vLeet
+							Debug.Assert(vLower[i] == chErased);
+						}
+					}
+					else
+					{
+						Array.Clear(vLower, i, nSubLen);
+						Debug.Assert(vLower[i] == chErased);
+					}
+				}
+
+				MemUtil.ZeroArray<char>(vSub);
+			}
+
+			MemUtil.ZeroArray<char>(vLower);
+			MemUtil.ZeroArray<char>(vLeet);
+		}
+
+		private static bool EvalAddPopularPasswordPattern(List<QePatternInstance>[] vPatterns,
+			char[] vPassword, int i, char[] vSub, double dblCostPerMod)
+		{
+			ulong uDictSize;
+			if(!PopularPasswords.IsPopularPassword(vSub, out uDictSize))
+				return false;
+
+			int n = vSub.Length;
+			int d = HammingDist(vSub, 0, vPassword, i, n);
+
+			double dblCost = Log2((double)uDictSize);
+
+			// dblCost += log2(n binom d)
+			int k = Math.Min(d, n - d);
+			for(int j = n; j > (n - k); --j)
+				dblCost += Log2(j);
+			for(int j = k; j >= 2; --j)
+				dblCost -= Log2(j);
+
+			dblCost += dblCostPerMod * (double)d;
+
+			vPatterns[i].Add(new QePatternInstance(i, n, PatternID.Dictionary,
+				dblCost));
+			return true;
+		}
+
+		private static char DecodeLeetChar(char chLeet)
+		{
+			if((chLeet >= '\u00C0') && (chLeet <= '\u00C6')) return 'a';
+			if((chLeet >= '\u00C8') && (chLeet <= '\u00CB')) return 'e';
+			if((chLeet >= '\u00CC') && (chLeet <= '\u00CF')) return 'i';
+			if((chLeet >= '\u00D2') && (chLeet <= '\u00D6')) return 'o';
+			if((chLeet >= '\u00D9') && (chLeet <= '\u00DC')) return 'u';
+			if((chLeet >= '\u00E0') && (chLeet <= '\u00E6')) return 'a';
+			if((chLeet >= '\u00E8') && (chLeet <= '\u00EB')) return 'e';
+			if((chLeet >= '\u00EC') && (chLeet <= '\u00EF')) return 'i';
+			if((chLeet >= '\u00F2') && (chLeet <= '\u00F6')) return 'o';
+			if((chLeet >= '\u00F9') && (chLeet <= '\u00FC')) return 'u';
+
+			char ch;
+			switch(chLeet)
+			{
+				case '4':
+				case '@':
+				case '?':
+				case '^':
+				case '\u00AA': ch = 'a'; break;
+				case '8':
+				case '\u00DF': ch = 'b'; break;
+				case '(':
+				case '{':
+				case '[':
+				case '<':
+				case '\u00A2':
+				case '\u00A9':
+				case '\u00C7':
+				case '\u00E7': ch = 'c'; break;
+				case '\u00D0':
+				case '\u00F0': ch = 'd'; break;
+				case '3':
+				case '\u20AC':
+				case '&':
+				case '\u00A3': ch = 'e'; break;
+				case '6':
+				case '9': ch = 'g'; break;
+				case '#': ch = 'h'; break;
+				case '1':
+				case '!':
+				case '|':
+				case '\u00A1':
+				case '\u00A6': ch = 'i'; break;
+				case '\u00D1':
+				case '\u00F1': ch = 'n'; break;
+				case '0':
+				case '*':
+				case '\u00A4': // Currency
+				case '\u00B0': // Degree
+				case '\u00D8':
+				case '\u00F8': ch = 'o'; break;
+				case '\u00AE': ch = 'r'; break;
+				case '$':
+				case '5':
+				case '\u00A7': ch = 's'; break;
+				case '+':
+				case '7': ch = 't'; break;
+				case '\u00B5': ch = 'u'; break;
+				case '%':
+				case '\u00D7': ch = 'x'; break;
+				case '\u00A5':
+				case '\u00DD':
+				case '\u00FD':
+				case '\u00FF': ch = 'y'; break;
+				case '2': ch = 'z'; break;
+				default: ch = chLeet; break;
+			}
+
+			return ch;
+		}
+
+		private static int HammingDist(char[] v1, int iOffset1,
+			char[] v2, int iOffset2, int nLength)
+		{
+			int nDist = 0;
+			for(int i = 0; i < nLength; ++i)
+			{
+				if(v1[iOffset1 + i] != v2[iOffset2 + i]) ++nDist;
+			}
+
+			return nDist;
+		}
+
+		private static void FindRepetitions(char[] vPassword,
+			List<QePatternInstance>[] vPatterns)
+		{
+			int n = vPassword.Length;
+			char[] v = new char[n];
+			Array.Copy(vPassword, v, n);
+
+			char chErased = char.MaxValue;
+			for(int m = (n / 2); m >= 3; --m)
+			{
+				for(int x1 = 0; x1 <= (n - (2 * m)); ++x1)
+				{
+					bool bFoundRep = false;
+
+					for(int x2 = (x1 + m); x2 <= (n - m); ++x2)
+					{
+						if(PartsEqual(v, x1, x2, m))
+						{
+							double dblCost = Log2(x1 + 1) + Log2(m);
+							vPatterns[x2].Add(new QePatternInstance(x2, m,
+								PatternID.Repetition, dblCost));
+
+							ErasePart(v, x2, m, ref chErased);
+							bFoundRep = true;
+						}
+					}
+
+					if(bFoundRep) ErasePart(v, x1, m, ref chErased);
+				}
+			}
+
+			MemUtil.ZeroArray<char>(v);
+		}
+
+		private static bool PartsEqual(char[] v, int x1, int x2, int nLength)
+		{
+			for(int i = 0; i < nLength; ++i)
+			{
+				if(v[x1 + i] != v[x2 + i]) return false;
+			}
+
+			return true;
+		}
+
+		private static void ErasePart(char[] v, int i, int n, ref char chErased)
+		{
+			for(int j = 0; j < n; ++j)
+			{
+				v[i + j] = chErased;
+				--chErased;
+			}
+		}
+
+		private static void FindNumbers(char[] vPassword,
+			List<QePatternInstance>[] vPatterns)
+		{
+			int n = vPassword.Length;
+			StringBuilder sb = new StringBuilder();
+
+			for(int i = 0; i < n; ++i)
+			{
+				char ch = vPassword[i];
+				if((ch >= '0') && (ch <= '9')) sb.Append(ch);
+				else
+				{
+					AddNumberPattern(vPatterns, sb, i - sb.Length);
+					sb.Remove(0, sb.Length);
+				}
+			}
+			AddNumberPattern(vPatterns, sb, n - sb.Length);
+		}
+
+		private static void AddNumberPattern(List<QePatternInstance>[] vPatterns,
+			StringBuilder sb, int i)
+		{
+			if(sb.Length <= 2) return;
+			string strNumber = sb.ToString();
+
+			int nZeros = 0;
+			for(int j = 0; j < strNumber.Length; ++j)
+			{
+				if(strNumber[j] != '0') break;
+				++nZeros;
+			}
+
+			double dblCost = Log2(nZeros + 1);
+			if(nZeros < strNumber.Length)
+			{
+				string strNonZero = strNumber.Substring(nZeros);
+
+#if KeePassLibSD
+				try { dblCost += Log2(double.Parse(strNonZero)); }
+				catch(Exception) { Debug.Assert(false); return; }
+#else
+				double d;
+				if(double.TryParse(strNonZero, out d))
+					dblCost += Log2(d);
+				else { Debug.Assert(false); return; }
+#endif
+			}
+
+			vPatterns[i].Add(new QePatternInstance(i, strNumber.Length,
+				PatternID.Number, dblCost));
+		}
+
+		private static void FindDiffSeqs(char[] vPassword,
+			List<QePatternInstance>[] vPatterns)
+		{
+			int n = vPassword.Length;
+			int d = int.MaxValue, p = 0;
+
+			for(int i = 1; i <= n; ++i)
+			{
+				int dCur = ((i == n) ? int.MinValue :
+					((int)vPassword[i] - (int)vPassword[i - 1]));
+				if(dCur != d)
+				{
+					if((i - p) >= 3) // At least 3 chars involved
+					{
+						QeCharType ct = GetCharType(vPassword[p]);
+						double dblCost = ct.CharSize + Log2(i - p - 1);
+
+						vPatterns[p].Add(new QePatternInstance(p,
+							i - p, PatternID.DiffSeq, dblCost));
+					}
+
+					d = dCur;
+					p = i - 1;
+				}
+			}
+		}
+
+		private static double Log2(double dblValue)
+		{
+#if KeePassLibSD
+			return (Math.Log(dblValue) / Math.Log(2.0));
+#else
+			return Math.Log(dblValue, 2.0);
+#endif
+		}
+	}
+}