Skip to content

Commit 453e819

Browse files
lubuxlubux
authored
Add support for the crypto refresh in v2 (#265)
This commit adds support for the OpenPGP crypto-refresh. - Updates go-crypto dependency to v1.1.0-alpha.1 - Adapts the session key logic to handle PKESK/SKESK v6 packets without an algorithm attached - Updates the min go version to 1.17 as requires by go-crypto v1.1.0-alpha.1 - Update the cricl dependency to 1.3.7 matching go-crypto Not supported: - crypto-refresh intended recipients - v6 key generation
1 parent c6a3058 commit 453e819

File tree

9 files changed

+92
-29
lines changed

9 files changed

+92
-29
lines changed

‎.github/test-suite/config.json.template

+4
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,10 @@
1717
{
1818
"path": "__SOP_OPENPGPJS__"
1919
},
20+
{
21+
"id": "gosop-v2",
22+
"path": "__GOSOP_V2__"
23+
},
2024
{
2125
"path": "__RNP_SOP__"
2226
}

‎.github/test-suite/prepare_config.sh

+1
Original file line numberDiff line numberDiff line change
@@ -8,5 +8,6 @@ cat $CONFIG_TEMPLATE \
88
| sed "s@__SQOP__@${SQOP}@g" \
99
| sed "s@__GPGME_SOP__@${GPGME_SOP}@g" \
1010
| sed "s@__SOP_OPENPGPJS__@${SOP_OPENPGPJS}@g" \
11+
| sed "s@__GOSOP_V2__@${GOSOP_DIR_V2}/gosop@g" \
1112
| sed "s@__RNP_SOP__@${RNP_SOP}@g" \
1213
> $CONFIG_OUTPUT

‎.github/workflows/go.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -23,16 +23,16 @@ jobs:
2323
run: go test -v -race ./...
2424

2525
test-old:
26-
name: Test with 1.15
26+
name: Test with 1.17
2727
runs-on: ubuntu-latest
2828
steps:
2929
- name: Check out repo
3030
uses: actions/checkout@v3
3131

32-
- name: Set up Go 1.15
32+
- name: Set up Go 1.17
3333
uses: actions/setup-go@v3
3434
with:
35-
go-version: 1.15
35+
go-version: 1.17
3636

3737
- name: Test
3838
run: go test -v -race ./...

‎.github/workflows/sop-test-suite.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ jobs:
4646
name: Run interoperability test suite
4747
runs-on: ubuntu-latest
4848
container:
49-
image: ghcr.io/protonmail/openpgp-interop-test-docker:v1.1.1
49+
image: ghcr.io/protonmail/openpgp-interop-test-docker:v1.1.4
5050
credentials:
5151
username: ${{ github.actor }}
5252
password: ${{ secrets.github_token }}
@@ -117,7 +117,7 @@ jobs:
117117
with:
118118
name: test-suite-results.json
119119
- name: Compare with baseline
120-
uses: ProtonMail/openpgp-interop-test-analyzer@v1
120+
uses: ProtonMail/openpgp-interop-test-analyzer@5d7f4b6868ebe3bfc909302828342c461f5f4940
121121
with:
122122
results: ${{ steps.download-test-results.outputs.download-path }}/test-suite-results.json
123123
output: baseline-comparison.json

‎crypto/key_clear.go

+36
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,12 @@ import (
88

99
"github.com/ProtonMail/go-crypto/openpgp/ecdh"
1010
"github.com/ProtonMail/go-crypto/openpgp/ecdsa"
11+
"github.com/ProtonMail/go-crypto/openpgp/ed25519"
12+
"github.com/ProtonMail/go-crypto/openpgp/ed448"
1113
"github.com/ProtonMail/go-crypto/openpgp/eddsa"
1214
"github.com/ProtonMail/go-crypto/openpgp/elgamal"
15+
"github.com/ProtonMail/go-crypto/openpgp/x25519"
16+
"github.com/ProtonMail/go-crypto/openpgp/x448"
1317
)
1418

1519
func (sk *SessionKey) Clear() (ok bool) {
@@ -61,6 +65,14 @@ func clearPrivateKey(privateKey interface{}) error {
6165
return clearEdDSAPrivateKey(priv)
6266
case *ecdh.PrivateKey:
6367
return clearECDHPrivateKey(priv)
68+
case *x25519.PrivateKey:
69+
return clearX25519PrivateKey(priv)
70+
case *ed25519.PrivateKey:
71+
return clearEd25519PrivateKey(priv)
72+
case *x448.PrivateKey:
73+
return clearX448PrivateKey(priv)
74+
case *ed448.PrivateKey:
75+
return clearEd448PrivateKey(priv)
6476
default:
6577
return errors.New("gopenpgp: unknown private key")
6678
}
@@ -126,3 +138,27 @@ func clearECDHPrivateKey(priv *ecdh.PrivateKey) error {
126138

127139
return nil
128140
}
141+
142+
func clearX25519PrivateKey(priv *x25519.PrivateKey) error {
143+
clearMem(priv.Secret)
144+
145+
return nil
146+
}
147+
148+
func clearEd25519PrivateKey(priv *ed25519.PrivateKey) error {
149+
clearMem(priv.Key[:ed25519.SeedSize])
150+
151+
return nil
152+
}
153+
154+
func clearX448PrivateKey(priv *x448.PrivateKey) error {
155+
clearMem(priv.Secret)
156+
157+
return nil
158+
}
159+
160+
func clearEd448PrivateKey(priv *ed448.PrivateKey) error {
161+
clearMem(priv.Key[:ed448.SeedSize])
162+
163+
return nil
164+
}

‎crypto/password.go

+1
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,7 @@ func DecryptSessionKeyWithPassword(keyPacket, password []byte) (*SessionKey, err
5757
key, cipherFunc, err := s.Decrypt(password)
5858
if err == nil {
5959
sk := &SessionKey{
60+
V6: s.Version == 6,
6061
Key: key,
6162
Algo: getAlgo(cipherFunc),
6263
}

‎crypto/sessionkey.go

+16-1
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ import (
1717

1818
// SessionKey stores a decrypted session key.
1919
type SessionKey struct {
20+
V6 bool
2021
// The decrypted binary session key.
2122
Key []byte
2223
// The symmetric encryption algorithm used with this key.
@@ -57,6 +58,9 @@ func (cr checkReader) Read(buf []byte) (int, error) {
5758
// GetCipherFunc returns the cipher function corresponding to the algorithm used
5859
// with this SessionKey.
5960
func (sk *SessionKey) GetCipherFunc() (packet.CipherFunction, error) {
61+
if sk.V6 {
62+
return 0, nil
63+
}
6064
cf, ok := symKeyAlgos[sk.Algo]
6165
if !ok {
6266
return cf, errors.New("gopenpgp: unsupported cipher function: " + sk.Algo)
@@ -107,6 +111,7 @@ func NewSessionKeyFromToken(token []byte, algo string) *SessionKey {
107111
return &SessionKey{
108112
Key: clone(token),
109113
Algo: algo,
114+
V6: algo == "",
110115
}
111116
}
112117

@@ -118,13 +123,14 @@ func newSessionKeyFromEncrypted(ek *packet.EncryptedKey) (*SessionKey, error) {
118123
break
119124
}
120125
}
121-
if algo == "" {
126+
if algo == "" && ek.Version < 6 {
122127
return nil, fmt.Errorf("gopenpgp: unsupported cipher function: %v", ek.CipherFunc)
123128
}
124129

125130
sk := &SessionKey{
126131
Key: ek.Key,
127132
Algo: algo,
133+
V6: ek.Version == 6,
128134
}
129135

130136
if err := sk.checkSize(); err != nil {
@@ -455,6 +461,12 @@ func decryptStreamWithSessionKey(
455461
}
456462

457463
func (sk *SessionKey) checkSize() error {
464+
if sk.V6 {
465+
if len(sk.Key) == 0 {
466+
return errors.New("empty session key")
467+
}
468+
return nil
469+
}
458470
cf, ok := symKeyAlgos[sk.Algo]
459471
if !ok {
460472
return errors.New("unknown symmetric key algorithm")
@@ -468,6 +480,9 @@ func (sk *SessionKey) checkSize() error {
468480
}
469481

470482
func getAlgo(cipher packet.CipherFunction) string {
483+
if cipher == 0 {
484+
return ""
485+
}
471486
algo := constants.AES256
472487
for k, v := range symKeyAlgos {
473488
if v == cipher {

‎go.mod

+12-4
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,20 @@
11
module github.com/ProtonMail/gopenpgp/v2
22

3-
go 1.15
3+
go 1.17
44

55
require (
6-
github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95
6+
github.com/ProtonMail/go-crypto v1.1.0-alpha.1
77
github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f
8-
github.com/davecgh/go-spew v1.1.1 // indirect
98
github.com/pkg/errors v0.9.1
109
github.com/stretchr/testify v1.7.0
11-
golang.org/x/crypto v0.7.0
10+
golang.org/x/crypto v0.17.0
11+
)
12+
13+
require (
14+
github.com/cloudflare/circl v1.3.7 // indirect
15+
github.com/davecgh/go-spew v1.1.0 // indirect
16+
github.com/pmezard/go-difflib v1.0.0 // indirect
17+
golang.org/x/sys v0.16.0 // indirect
18+
golang.org/x/text v0.14.0 // indirect
19+
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect
1220
)

‎go.sum

+17-19
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,12 @@
1-
github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 h1:KLq8BE0KwCL+mmXnjLWEAOYO+2l2AE4YMmqG1ZpZHBs=
2-
github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95/go.mod h1:EjAoLdwvbIOoOQr3ihjnSoLZRtE8azugULFRteWMNc0=
1+
github.com/ProtonMail/go-crypto v1.1.0-alpha.1 h1:iKLDnKGL+3u4Q5OjYgixAxWdkkGBPidCQumqVryUgtY=
2+
github.com/ProtonMail/go-crypto v1.1.0-alpha.1/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
33
github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f h1:tCbYj7/299ekTTXpdwKYF8eBlsYsDVoggDAuAjoK66k=
44
github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f/go.mod h1:gcr0kNtGBqin9zDW9GOHcVntrwnjrK+qdJ06mWYBybw=
55
github.com/bwesterb/go-ristretto v1.2.3/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
6-
github.com/cloudflare/circl v1.3.3 h1:fE/Qz0QdIGqeWfnwq0RE0R7MI51s0M2E4Ga9kq5AEMs=
7-
github.com/cloudflare/circl v1.3.3/go.mod h1:5XYMA4rFBvNIrhs50XuiBJ15vF2pZn4nnUKZrLbUZFA=
6+
github.com/cloudflare/circl v1.3.7 h1:qlCDlTPz2n9fu58M0Nh1J/JzcFpfgkFHHX3O35r5vcU=
7+
github.com/cloudflare/circl v1.3.7/go.mod h1:sRTcRWXGLrKw6yIGJ+l7amYJFfAXbZG0kBSc8r4zxgA=
8+
github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
89
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
9-
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
10-
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
1110
github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
1211
github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
1312
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -18,17 +17,15 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
1817
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
1918
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
2019
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
21-
golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
22-
golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A=
23-
golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
20+
golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=
21+
golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
2422
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
2523
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
2624
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
2725
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
2826
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
29-
golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
3027
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
31-
golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
28+
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
3229
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
3330
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
3431
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -37,23 +34,24 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w
3734
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
3835
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
3936
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
40-
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
41-
golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
4237
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
43-
golang.org/x/sys v0.6.0 h1:MVltZSvRTcU2ljQOhs94SXPftV6DCNnZViHeQps87pQ=
44-
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
38+
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
39+
golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
40+
golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU=
41+
golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
4542
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
4643
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
47-
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
4844
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
49-
golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
45+
golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
46+
golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
5047
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
5148
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
5249
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
53-
golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
5450
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
55-
golang.org/x/text v0.8.0 h1:57P1ETyNKtuIjB4SRd15iJxuhj8Gc416Y78H3qgMh68=
5651
golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
52+
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
53+
golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
54+
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
5755
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
5856
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
5957
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=

0 commit comments

Comments
 (0)