crypto

345 Commits 11 Branches 57 Tags

2 Commits

Author	SHA1	Message	Date
KB Sriram	c10c31b5e9	x/crypto/openpgp: cross-signature validation for signing subkeys. Section 11.1 of RFC4880 requires that binding signatures on signing subkeys contain a valid embedded signature that cross-certifies the primary key. This is to avoid the weakness described at https://www.gnupg.org/faq/subkey-cross-certify.html Fixes #10740 Change-Id: Ibe039662497832945957b001a83080ba29213703 Reviewed-on: https://go-review.googlesource.com/9799 Reviewed-by: Adam Langley <agl@golang.org>	2015-05-31 18:57:27 +00:00
KB Sriram	24ffb5feb3	x/crypto/openpgp: Limit packet recursion depth. A carefully crafted packet can cause the packet reader to push an infinite number of recursive packet readers. This change limits the number of recursive parsing levels within the packet reader. More details at: http://mumble.net/~campbell/misc/pgp-quine https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4402 Fixes #10751 Change-Id: Ib4e102d85f6496e2c7feb5b9d7e5db45db6032df Reviewed-on: https://go-review.googlesource.com/9843 Reviewed-by: Adam Langley <agl@golang.org>	2015-05-08 01:16:24 +00:00

Author

SHA1

Message

Date

KB Sriram

c10c31b5e9

x/crypto/openpgp: cross-signature validation for signing subkeys.

Section 11.1 of RFC4880 requires that binding signatures on
signing subkeys contain a valid embedded signature that cross-certifies
the primary key. This is to avoid the weakness described at
https://www.gnupg.org/faq/subkey-cross-certify.html

Fixes #10740

Change-Id: Ibe039662497832945957b001a83080ba29213703
Reviewed-on: https://go-review.googlesource.com/9799
Reviewed-by: Adam Langley <agl@golang.org>

2015-05-31 18:57:27 +00:00

KB Sriram

24ffb5feb3

x/crypto/openpgp: Limit packet recursion depth.

A carefully crafted packet can cause the packet reader to push an
infinite number of recursive packet readers. This change limits
the number of recursive parsing levels within the packet reader.

More details at:
http://mumble.net/~campbell/misc/pgp-quine
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4402

Fixes #10751

Change-Id: Ib4e102d85f6496e2c7feb5b9d7e5db45db6032df
Reviewed-on: https://go-review.googlesource.com/9843
Reviewed-by: Adam Langley <agl@golang.org>

2015-05-08 01:16:24 +00:00