FubarDev.Lexware.Passwords 0.1.0

FubarDev.Lexware.Passwords

A cross-platform .NET library for encrypting and decrypting Lexware passwords.

Overview

Lexware products store user passwords in several encrypted formats that have evolved over time. This library provides a unified API to encrypt and decrypt these stored password values across all known schemes:

• Legacy / V0: DES-CBC encryption, stored as lowercase hex ASCII bytes, no version prefix. V0 is the formalized variant of the legacy scheme and is fully equivalent to it.
• V1: '1' prefix + AES-192-ECB with minimal escape encoding
• V2: '2' prefix + AES-192-ECB with escape encoding and cyclic XOR
• V3: '3' prefix + AES-192-ECB with random-byte interleaving (non-deterministic)
• V4: '4' prefix + AES-192-ECB with full escape encoding (current Lexware default)

The library also supports double encryption (used for migration scenarios) and provides a date-based service password generator (PasswordForToday).

Features

• Encrypt and decrypt passwords for all Lexware encryption schemes (Legacy, V0--V4)
• Auto-detect the encryption scheme during decryption via a multiplexer
• Interface-based design with a static factory for easy consumption
• Optional double encryption support for migration scenarios
• Date-based service password generation
• Thread-safe, cross-platform, Native AOT and trimming compatible
• No external runtime dependencies beyond the .NET Base Class Library
• Optional delegation to the original LxEncrDecr.dll (requires a valid, locally installed Lexware license)

Target Framework

• .NET 10 / C# 14

Installation

dotnet add package FubarDev.Lexware.Passwords

Or via the NuGet Package Manager in Visual Studio by searching for FubarDev.Lexware.Passwords.

Usage

All types live in the FubarDev.Lexware.Passwords namespace. The main entry point is the static LxCryptoApi class.

Decrypt a stored password (auto-detect scheme)

The most common use case: read a raw stored value from the database and decrypt it without knowing the scheme in advance.

using FubarDev.Lexware.Passwords;

// Works for Legacy DES (V0), V1, V2, V3, and V4.
string plaintext = LxCryptoApi.Managed.DecryptAny(storedBytes);

Encrypt a password using the current default scheme (V4)

using FubarDev.Lexware.Passwords;

ILexwarePasswordEncryptor encryptor = LxCryptoApi.Managed[4]; // V4 is the current default
byte[] stored = encryptor.Encrypt("MyPassword");

Round-trip for a specific scheme version

using FubarDev.Lexware.Passwords;

ILexwarePasswordEncryptor encryptor = LxCryptoApi.Managed[4];
byte[] stored    = encryptor.Encrypt("MyPassword");
string plaintext = encryptor.Decrypt(stored);

Use the original Lexware DLL (optional, Windows x86 only)

The Native implementation delegates to LxEncrDecr.dll from a local Lexware installation and falls back to the managed implementation automatically when the DLL is unavailable or the process is not x86.

using FubarDev.Lexware.Passwords;

// Transparent fallback: uses LxEncrDecr.dll if available, managed otherwise.
// Note: V2 always uses the managed fallback regardless of DLL availability.
string plaintext = LxCryptoApi.Native.DecryptAny(storedBytes);

If you need an explicit guard before using native mode:

using FubarDev.Lexware.Passwords;

ILxCryptoApi api = LxCryptoApi.IsNativeSupported
    ? LxCryptoApi.Native
    : LxCryptoApi.Managed;

string plaintext = api.DecryptAny(storedBytes);

For direct native access without any managed fallback, use NativeDirect — but only after confirming IsNativeSupported:

using FubarDev.Lexware.Passwords;

if (LxCryptoApi.IsNativeSupported)
{
    string plaintext = LxCryptoApi.NativeDirect.DecryptAny(storedBytes);
}

Requirements for native mode:

• Windows operating system
• x86 (32-bit) process
• LxEncrDecr.dll resolvable at runtime from your local Lexware installation

The LxEncrDecr.dll is not included in this package and is not redistributed. It is loaded at runtime from the locally installed, licensed Lexware application.

Low-level DES operations

For direct access to the legacy DES layer:

using FubarDev.Lexware.Passwords;

string hexCiphertext = DesEncryption.Encrypt("MyPassword");
string plaintext     = DesEncryption.Decrypt(hexCiphertext);

Date-based service password

using FubarDev.Lexware.Passwords;

string todayPassword = PasswordForToday.Generate();                              // uses today's date
string specificDay   = PasswordForToday.Generate(new DateOnly(2026, 3, 14));     // specific date

Purpose and Intended Use

This library was developed exclusively to enable third-party applications to interoperate with locally installed, licensed Lexware Financial Office installations.

Lexware Financial Office does not provide a machine-readable data export for all data categories. Where only human-readable reports are available, programmatic access to the underlying database is the only viable approach. This library allows such third-party applications to authenticate using the same credentials already established in Lexware, rather than relying on known default credentials or other publicly documented access paths.

This library is intended solely for use by licensed Lexware users who wish to access their own data from their own licensed installation.

Legal Notice

Interoperability

The algorithms implemented in this library were obtained by means of reverse engineering for the sole purpose of achieving interoperability with Lexware Financial Office, as expressly permitted under § 69e UrhG (German Copyright Act) and § 3 GeschGehG (German Trade Secrets Act). The necessity of this approach was established by the absence of any machine-readable data export covering the required data categories.

Contractual clauses that purport to prohibit reverse engineering for interoperability purposes are void by operation of law under § 69g Abs. 2 UrhG.

Scope of Use

This library is provided for interoperability purposes only. It is intended exclusively for use with licensed Lexware installations by the respective licensee to access their own data. Any use that exceeds this scope — in particular unauthorized access to third-party systems — is not a supported or intended use case and is the sole responsibility of the user.

No Redistribution of Lexware Components

This library does not include, embed, or redistribute any component, binary, or asset owned by Lexware or Haufe Group. The optional LxEncrDecr.dll integration requires the user to provide the path to a DLL from their own licensed Lexware installation.

Liability Disclaimer

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Use of this library is at your own risk. The authors assume no liability for any consequences arising from use outside the intended interoperability scope described above.

Security Note

The encryption schemes documented and implemented in this library reflect security design decisions made by Lexware / Haufe Group. The authors of this library make no representation regarding the security of these schemes and expressly note that reversible password storage does not conform to current security best practices (e.g., NIST SP 800-63B, BSI TR-02102). Users should be aware of the inherent limitations of the underlying Lexware security architecture.

License

Copyright (c) 2025 Fubar Development Junker

This project is licensed under the MIT License.