eiac/crypto
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
298 Commits 11 Branches 57 Tags
fc08251b062a494de96158df024e1da5800a1685
Commit Graph
10 Commits
Author SHA1 Message Date
Brian Gitonga Marete ae8e58be79 openpgp: Fix panic on v3 public keys with too-short modulus. 
Found using gofuzz.

Fixes golang/go#11504

Change-Id: I49cf01e75e37c5d87dad58c5349161d79d0b72f5
Reviewed-on: https://go-review.googlesource.com/12635
Reviewed-by: Adam Langley <agl@golang.org>
 2015-07-27 22:43:05 +00:00
Brian Gitonga Marete cb32d3bd66 openpgp: Fix panic on opaque subpackets with length 0. 
Some invalid input may be parsed so that the length of an opaque
subpacket turns out to be 0. In such cases, arrange for a
StructuralError to be returned indicating truncation.

Found using gofuzz.

Fixes golang/go#11503

Change-Id: Ib9ce8c604f35a31f852adfcd56a22dfd143a9443
Reviewed-on: https://go-review.googlesource.com/12634
Reviewed-by: Adam Langley <agl@golang.org>
 2015-07-27 22:29:30 +00:00
KB Sriram 24ffb5feb3 x/crypto/openpgp: Limit packet recursion depth. 
A carefully crafted packet can cause the packet reader to push an
infinite number of recursive packet readers. This change limits
the number of recursive parsing levels within the packet reader.

More details at:
http://mumble.net/~campbell/misc/pgp-quine
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4402

Fixes #10751

Change-Id: Ib4e102d85f6496e2c7feb5b9d7e5db45db6032df
Reviewed-on: https://go-review.googlesource.com/9843
Reviewed-by: Adam Langley <agl@golang.org>
 2015-05-08 01:16:24 +00:00
David Leon Gil 632d287f9f crypto/openpgp: support public keys generated by End-to-End 
packet/packet.go: add ECDSA to the algorithms in CanSign()
packet/signature.go: add support for the features subpacket (which is
used to signal support for the MDC packet)
openpgp/read_test.go: add a key generated by End-to-End as a testcase
(End-to-End's keys are unusual: they set critical bits)

Change-Id: Ifaf3922cd35ea27cf1276d7a8238dd50536eb4ed
Reviewed-on: https://go-review.googlesource.com/2058
Reviewed-by: Adam Langley <agl@golang.org>
 2015-01-06 19:53:31 +00:00
Andrew Gerrand a73c6bbfc5 go.crypto: use golang.org/x/... import paths 
LGTM=bradfitz
R=rsc, bradfitz
CC=golang-codereviews
https://golang.org/cl/167190043
 2014-11-10 08:50:25 +11:00
Adam Langley 3092f0d93b go.crypto/openpgp: return signature error rather than unknown issuer. 
In the event that a detached signature fails to verify, the code would
continue trying to find other keys with the same key ID and eventually
conclude that the signature was issued by someone unknown
(ErrUnknownIssuer).

With this change, the signature verification error would be returned
instead. (Technically the last error if several keys had a matching key
id and neither verified.)

Fixes golang/go#8509.

LGTM=bradfitz
R=bradfitz
CC=golang-codereviews
https://golang.org/cl/125030043
 2014-08-11 15:41:56 -07:00
Adam Langley aeb0262c11 go.crypto/openpgp: fix hash presence checks. 
At some point in the distant past, crypto.Hash.New() changed from
returning nil when a hash function wasn't provided, to panicing. Some
of the code in openpgp predates this and was still using the nil check.

LGTM=bradfitz
R=sburford, bradfitz
CC=golang-codereviews
https://golang.org/cl/104850045
 2014-06-04 11:40:03 -07:00
Adam Langley 7bb6c099c0 go.crypto/openpgp: support v3 detached signatures. 
Although the package doesn't attempt to fully support ancient, version
3 messages, supporting v3 detached signatures is fairly easy and some
projects (in this case, Ubuntu) are using them for unknown reasons.

R=golang-dev, r
CC=golang-dev
https://golang.org/cl/14590043
 2013-10-09 17:24:09 -04:00
Adam Langley 54eafe1dea openpgp: eliminate implicit rand.Reader and time.Now 
Fixes golang/go#2501.

R=rsc, bradfitz
CC=golang-dev
https://golang.org/cl/5653067
 2012-02-20 10:48:21 -05:00
Russ Cox 470549d502 go.crypto: initial code 
Manual edits to README.
Moved from main Go repository, deleted Makefiles, ran gofix -r go1rename.

Tested with: go test code.google.com/p/go.crypto/...

R=golang-dev, bradfitz
CC=golang-dev
https://golang.org/cl/5564059
 2012-01-25 15:31:12 -05:00