MPIs are (supposed to be) stripped of leading zeroes. Avoid passing
such short values into crypto/rsa, even if it currently happens to work.
Change-Id: I5a5f4813b8358e83fcc2deeda1272d2733814542
Reviewed-on: https://go-review.googlesource.com/100844
Reviewed-by: Adam Langley <agl@golang.org>
Rather than rounding the `type || X || Y` byte sequence to the next
8-bit boundary, packet.NewECDSAPublicKey() now rounds the X and Y
coordinates individually, then adds the bitlength 3 of type 4
(compressed). For NIST P-256, this leads to a bit length of 515,
rather than 520. GnuPG calculates 515 as well, and
https://tools.ietf.org/html/rfc6637#section-6 explicitly states that
"the exact size of the MPI payload is 515 bits for 'Curve P-256,'"
so the new formula is consistent.
Fixesgolang/go#23460
Change-Id: I64b340d1c761bfd795a1a64dc2f7a831c8b2ff32
Reviewed-on: https://go-review.googlesource.com/87995
Reviewed-by: Adam Langley <agl@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Adam Langley <agl@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
The existing implementation checks to see if the session key size is a
multiple of the cipher blocksize. This fails for AES-192, which has a
keysize of 24 bytes and a 16 byte block size. Instead it should simply
check to ensure that the Session Key length is equal to the cipher
KeySize.
Fixesgolang/go#17060
Change-Id: I1dc78129f7fb2ca5ec71b650a2adcb3752dca885
Reviewed-on: https://go-review.googlesource.com/35848
Reviewed-by: Adam Langley <agl@golang.org>
Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
Run-TryBot: Adam Langley <agl@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
This adds support for crypto.Signer-based RSA and ECDSA private keys.
This enables using opaque signing keys as explained in the documentation
for crypto.Signer.
The support is in the form of a new NewSignerPrivateKey function which
makes a PrivateKey from a crypto.Signer.
Fixesgolang/go#15841.
Change-Id: Ice2ec2793a9f5409a5bfd4e5e49d919e14ede1e0
Reviewed-on: https://go-review.googlesource.com/23802
Run-TryBot: Adam Langley <agl@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Adam Langley <agl@golang.org>
Signature#SignUserId was ignoring the error returned by userIdSignatureHash.
This error can happen, for example, when the Signature's Hash property is
uninitialized. Not returning the error makes it hard for the user to detect
the problem.
Change-Id: I0ae0033e77bfb1ea1c06b0769f949e48c713adc6
Reviewed-on: https://go-review.googlesource.com/27997
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
When writing keys that contain ElGamal subkeys, the openpgp
package would previously return an error.
Change-Id: I1c487f4a9cfb92b40e99e9be6aa4ed5928e36dbe
Reviewed-on: https://go-review.googlesource.com/18254
Reviewed-by: Adam Langley <agl@golang.org>
SymmetricKeyEncrypted cached the results of decryption so, if a bad
password was given, ReadMessage would prompt forever because a later,
correct password wouldn't override the cached decryption.
The SymmetricKeyEncrypted object can't know whether a given passphrase
is correct so it should never have been a mutable object in the first
place. This change makes it so that it doesn't cache anything.
Fixes#9315
Change-Id: Ic2b75f7f60a575e2182ac7e5c5d4198597c5d0a2
Reviewed-on: https://go-review.googlesource.com/14038
Reviewed-by: Andrew Gerrand <adg@golang.org>
Reviewed-by: Adam Langley <agl@golang.org>
parseRSAPrivateKey calls rsa.PrivateKey.Precompute which triggers
divide-by-zero panic if either p or q is 1. Sanity check the parsed
values by calling rsa.PrivateKey.Validate.
Fixesgolang/go#11505
Change-Id: Ia6c9eccca0cfa49aaa58716e708c557a788bb204
Reviewed-on: https://go-review.googlesource.com/12356
Reviewed-by: Adam Langley <agl@golang.org>
Some invalid input may be parsed so that the length of an opaque
subpacket turns out to be 0. In such cases, arrange for a
StructuralError to be returned indicating truncation.
Found using gofuzz.
Fixesgolang/go#11503
Change-Id: Ib9ce8c604f35a31f852adfcd56a22dfd143a9443
Reviewed-on: https://go-review.googlesource.com/12634
Reviewed-by: Adam Langley <agl@golang.org>
The new function allows an existing encrypted key packet
to be serialized to a Writer.
Change-Id: I20d82ca473d8ae738d239068626897c1ff868a15
Reviewed-on: https://go-review.googlesource.com/3167
Reviewed-by: Adam Langley <agl@golang.org>
packet/packet.go: add ECDSA to the algorithms in CanSign()
packet/signature.go: add support for the features subpacket (which is
used to signal support for the MDC packet)
openpgp/read_test.go: add a key generated by End-to-End as a testcase
(End-to-End's keys are unusual: they set critical bits)
Change-Id: Ifaf3922cd35ea27cf1276d7a8238dd50536eb4ed
Reviewed-on: https://go-review.googlesource.com/2058
Reviewed-by: Adam Langley <agl@golang.org>
This patch allows the user to choose the strength of the
passphrase mangling during the process in which the key is
produced from the passphrase. It only affects symmetric
encryption.
Unmodified code that calls openpgp.SymmetricallyEncrypt() will
continue to get the now-default count of 65536. Otherwise, a
count in the range [1024, 65011712] may be configured. Illegal
values in and outside this range will silently be rounded up
to legal values within the said range.
The test to s2k.Serialize() has been modified to test a
variety of non-default counts with all the valid hashes and
ensure that the decoding component of s2k can parse and
decrypt the result.
Additional testing has been done with GPG to ensure that the
latter can parse and decrypt files encrypted/encoded with
various counts.
LGTM=agl
R=golang-codereviews, agl
CC=golang-codereviews
https://golang.org/cl/176080043
This patch/CL allows the user to configure the hash function
used in the s2k key-stretching transformation during
encryption. It fixes the current limitation in which SHA1 is
hard-coded for that task.
With this change, packet.Config.DefaultHash is used by default
for the mode 3 s2k key-stretching that is currently used for
encryption, but the user may choose any other valid openpgp
hash by passing a new (possibly nil) pointer argument to
s2k.Serialize().
Note that this change introduces an API change to
s2k.Serialize() in the form of an additional
argument. However, the s2k package is a low-level facility
that (as far as I could tell) is used directly by
go.crypto/openpgp only.
The CL comes with an modified test to check the use and
decoding of all the valid hash functions with regard to
s2k.Serialize().
This patch should be followed by one that allows the user to
configure the iteration count in mode 3 s2k, and it is a
prerequisite for that forthcoming change.
R=golang-codereviews, agl
CC=agl, golang-codereviews
https://golang.org/cl/160110045
Since the decryption was done in place, if an incorrect key was given,
the encrypted data would be corrupted.
Fixesgolang/go#8439.
R=bradfitz
CC=golang-codereviews
https://golang.org/cl/115550043
At some point in the distant past, crypto.Hash.New() changed from
returning nil when a hash function wasn't provided, to panicing. Some
of the code in openpgp predates this and was still using the nil check.
LGTM=bradfitz
R=sburford, bradfitz
CC=golang-codereviews
https://golang.org/cl/104850045
Entity.SignIdentity used the wrong signature function and produced invalid
certification signatures. Fixed.
VerifyUserIdSignature was used for checking the self-signature on an identity,
but didn't support anything but a self-signature. This change alters the
low-level API so that checking cross-signatures is possible.
Fixesgolang/go#7371.
LGTM=bradfitz
R=bradfitz
CC=golang-codereviews
https://golang.org/cl/96240043
Necessary to reproduce the same hash for verifying a UserAttribute signature.
Reuse and fix defect in serializeSubpacketLength, RFC 4880, Section 4.2.2.2.
R=agl
CC=golang-dev
https://golang.org/cl/13464044
My goal here is to allow read-only access to legacy key material without allowing new V3 keys or signatures.
R=agl
CC=golang-dev
https://golang.org/cl/12746046
Supports JPEG images as well as free-form arbitrary subpacket data in
user attributes (RFC 4880, Section 5.12)
R=agl
CC=golang-dev
https://golang.org/cl/12966045
This patch implements the facilities needed to compress data before
encryption as allowed (and recommended) by RFC 4880. The new
functionality is then used to add support for compressing data during
symmetric encryption (openpgp.SymmetricallyEncrypt()).
For now, compression defaults to off. Also, only the ZIP and ZLIB
compression schemes are supported by this patch.
Resulting output tested/verified using GPG.
https://gist.github.com/marete/6189760 is a small program that can be
used to test that the output of various compression/encryption settings
can be read by GPG or other RFC 4880 programs.
Upon review, I will follow this patch with 2 others: a) Add support for compression during public key encryption (openpgp.Encrypt()) b) Enable
compression by default (subject to the restrictions of the "Compression Preferences" section in RFC 4880).
R=golang-dev, agl
CC=golang-dev
https://golang.org/cl/12685044
Tested using a variety of files encrypted with gpg and the
"--compress-algo BZIP2" gpg option.
R=golang-dev, bradfitz, agl
CC=golang-dev
https://golang.org/cl/10801043
I ran go vet over all of go.crypto and removed lots of panic("unreachable") that are no longer needed.
R=golang-dev, r, dgryski
CC=golang-dev
https://golang.org/cl/10113043
This is a followup to issue 6927044. I *really* don't want to
break streaming for large encrypted data packets.
Removing the automatic re-parsing. OpaqueReader can be
used for recovering useful information from mangled/unsupported packets.
R=agl
CC=golang-dev
https://golang.org/cl/6944056
These are improvements I've made as necessary to develop Hockeypuck,
an OpenPGP keyserver (https://launchpad.net/hockeypuck).
The max armor line length was increased to 96 because some keyservers (SKS)
will output armor with lines greater than 64 (the prior max).
I've exposed packet.ReadEntity to support stream-parsing, useful for
large SKS dump files.
ReadKeyRing attempts to recover in the event of malformed data.
Because many packet types are not yet supported, I added OpaquePacket to
capture unsupported types for offline storage and later reparsing.
R=agl
CC=golang-dev
https://golang.org/cl/6927044
It appears that CentOS (and so I presume Fedora/RHEL too) default to
encrypting private keys with 3DES so it looks like we need to support
that.
Fixesgolang/go#3940.
R=golang-dev, r
CC=golang-dev
https://golang.org/cl/6446121
Clear signed messages are often seen in email and are formatted so
that the plaintext of the signed message is readable without any
special tools.
R=golang-dev, bradfitz
CC=golang-dev
https://golang.org/cl/5604043
Manual edits to README.
Moved from main Go repository, deleted Makefiles, ran gofix -r go1rename.
Tested with: go test code.google.com/p/go.crypto/...
R=golang-dev, bradfitz
CC=golang-dev
https://golang.org/cl/5564059
Filippo Valsorda
Mike Tsao
Lars Lehtonen
namusyaka
mdp
Joe Tsai
Samuele Pedroni
Reinaldo de Souza Jr
Jacob H. Haven
Sami Commerot
Adam Langley
Michael Gehring
Jeff R. Allen
Brian Gitonga Marete
KB Sriram
Giovanni Bajo
David Leon Gil
David Symonds
Andrew Gerrand
Casey Marshall
Mikio Hara
Russ Cox