eVaf Tutorial

01 - Introduction

On this page we write an application using the eVaf application development framework. Knowledge of the C++ programming language and Qt application and UI framework are required. The tutorial is written for Linux, but with small modifications the same application can be written on Windows.

Specification

We try to be good programmers and start with a short specification for the application before writing any code.

In 2011 the PlayStation Network was hacked and sensitive data including user names and passwords stolen. I as many other normal people used the same password on PSN as well as on many other online services. Once one of them was compromised, all the passwords needed to be changed.

We are most secure when we use unique passwords for each and every web site and online service. So let us write an application that can be used to generate unique passwords. We do it in such a way that whenever we need to re-enter a password, we can re-create it without actually storing the password on our hard disks.

For this we are going to write a password generator using cryptographic hash functions. By feeding the password generator with the same input data, we end up with the same password. All we need to remember is the input data we entered when generating the password.

For the input data, we can combine a name of the online service with a master password that only we know. We do not store the master password, do not send it to any of the web pages nor can it be figured out from the generated password. Only things that we may want to store are optional parameters for the password generator, like the length of the password.

The application is simple and, for example, Firefox already has many add-ons that do exactly what we are going to write. To make it an eVaf application, we are going to split it into modules and define interfaces to work with them. Every module does it's on job and can be easily replaced if we wanted so:

Generator -- Module that generates passwords using a cryptographic hash function. We are going to use simple MD5 hash function in this tutorial, but it can be replaced with better methods that are more collision resistant than MD5.
Storage -- Module that stores optional parameters for the password generator. As these parameters are actually not sensitive information, we do not use any encryption here, but the module can be replaced with another one that uses encryption.
User Interface -- Module that implements the GUI for the application.

Generator Module

The Generator module really needs to do only one job -- generate passwords in such a way that by feeding it with the same input data, the same password gets generated. Input data for the password generator is:

Name -- Name of the application, online service or web page for which the password is generated. This could be, for example, "facebook.com" or "google.com".
Master Password -- Password that only we know and is used for all the generated passwords.
Length -- Length of the generated password. We prefer passwords that are as long as possible, but some applications or web sites may require passwords that are shorter.
Options -- Additional parameters for the password generator. We are not going to use these in this tutorial, but they could be used to force the password generator to use a limited set of characters, like alpha-numeric only etc.

We also may want to know the maximum length of the generated password. The maximum length depends on the cryptographic hash function used in the module and we need a function in the interface for this.

Storage Module

The Storage module stores non-sensitive data required to re-generate passwords:

Name -- The same name of the application, online service or web page that was used in the Generator module.
Length -- Length of the password.
Options -- Additional parameters for the password generator if they were used.

We need a function in the interface that can be used to store input data for the generator when a password is generated.

We also need functions to query stored data identified by the Name value. The query function could work with partial matches so that when we enter "fa" into the user interface, it offers "facebook.com" if this record is found.

User Interface Module

The User Interface module provides us with a window where we can enter necessary input data and generate passwords. Once the password is generated, we want it to store non-sensitive input data and optionally copy the generated password to the clipboard.

If the Storage module supports this, then the User Interface module could also offer existing names based on the initial input.

In the next section 02 - Preparations we prepare the development environment.