A Personal Virtual Keyboard for (nearly) Every Keyboard

Introduction

I have been working for a number years on PasswordSafe, a popular password manager and an Open Source project. Recently, there was a discussion about the security of using On-Screen Keyboards. This set me thinking - what if a Japanese user of this application went to visit a friend in Europe, how would they enter their passphrase to open their password database when, most likely, their friend's PC had neither a Japanese keyboard installed nor any other software to generate Japanese characters? Of course, the user could enter the characters directly using the Numeric Key pad and the Alt key - but who would want to remember 8 or more Unicode values of a passphrase instead of typing characters they recognise?

A solution, detailed below, enabled me to include nearly all keyboards supported in Windows in the PasswordSafe application, allowing users to effectively take the keyboard with them where-ever they go, without the keyboards being physically available and without installing any additional software on the PCs - maybe none at all if PasswordSafe is on a USB memory stick. It could even be used as a countermeasure to brute force attacks on the passphrase by, say, starting with Latin characters and then adding a few Greek then Hebrew and possibly ending with a Thai or Japanese character! If you wish, you could even design your own keyboard layout with a mixture of different characters from different keyboards and languages and include it via the XML facility described below.

As it is implemented via a standard DLL, it should be available for use by many languages/frameworks - for example: C, C++, C#, Visual Basic and MFC, .Net, wxWidgets etc..

In my research, I came across an extremely good set of articles by Michael S. Kaplan, of Microsoft, in his MSDN Blog Sorting it all Out, Getting all you can out of a keyboard layout (Part 0 to Part 9b) between March 23 and April 13, 2006) - I recommend reading the complete series and his other articles.

In this set of articles, culminating in a very useful piece of code in Part 9b, Mr Kaplan uses standard calls to well documented Windows APIs (LoadKeyboardLayout, UnloadKeyboardLayout, ToUnicodeEx, VkKeyScanEx, MapVirtualKeyEx, GetKeyboardLayoutList) to retrieve and print the result of pressing keys on any keyboard installed on the PC on which it is run - including multiple characters generated by pressing only one key and composite characters formed by pressing Dead Keys ("Dead Keys" are keys that, when combined with another key, produce a composite key, for example, to add an accent above a vowel. In the Danish keyboard, for example, pressing the Dead Key showing the acute accent (´) displays a number of allowable combination characters (a, e, y, u, i and o). Then pressing the 'o' key gives composite character: ò).

The following four figures are examples of the 127 various keyboards that can be presented to users based on the code described in this article.

• Japanese Keyboard

  
  (Full Size Image)

• US Standard 101-key Keyboard with Randomised Keys

  
  (Full Size Image)

• Canadian Multi-Lingual Standard Keyboard showing a Dead Key in orange

  
  (Full Size Image)

• Canadian Multi-Lingual Standard Keyboard showing the composite keys when that particular Dead Key has been pressed

  
  (Full Size Image)

The only requirement of the target PC is having a Unicode font installed, as this is only way to display all the international characters in a dialog. For PasswordSafe, I try for the following four in order:

1. A font selected by the user through a normal CFontDialog interface. There are no guarantees that all characters will be displayed properly using this font. The user must verify that their selected font displays the characters they want to use. This option is not included in the Demo application attached to this article.
2. Arial Unicode MS. This comes with most modern versions of Microsoft Office.
3. Arial Unicode. This is the same as "Arial Unicode MS" except it is sold separately and does not require Microsoft Office to be installed.
4. Lucida Unicode Sans. This comes with most Windows versions supporting Unicode (i.e. Windows NT and later).

The Demo application displays which font it found and is using.

An IBM mainframe specialist who thinks that it is the best platform ever, as are mainframe Assembler and PL/1 the best programming languages! However, not able to have his own mainframe at home to play with, he has been programming for Windows for many years, the majority using C++ and MFC. He is one of the lead developers for the Open Source program - PasswordSafe.