PGPainless/pgpainless
PGPainless/pgpainless
1
0
Fork 0
mirror of https://github.com/pgpainless/pgpainless.git synced 2025-09-13 12:19:38 +02:00
Code Issues Releases Wiki Activity

Remove support for processing compressed detached signatures

Browse source 
Signatures are indistinguishable from randomness, so there is no point in
compressing them, apart from attempting to exploit flaws in compression
algorithms.
Thanks to @DemiMarie for pointing this out

Fixes #286
This commit is contained in:
Paul Schaub 2022-05-07 21:46:03 +02:00
parent d3f412873b
commit 49d65788b4
2 changed files with 1 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

19
pgpainless-core/src/test/java/org/pgpainless/signature/SignatureUtilsTest.java
View file

@ -12,28 +12,9 @@ import java.util.List;
import org.bouncycastle.openpgp.PGPException;
import org.bouncycastle.openpgp.PGPSignature;
import org.junit.jupiter.api.Test;
import org.pgpainless.key.util.KeyIdUtil;
public class SignatureUtilsTest {
@Test
public void readSignaturesFromCompressedData() throws PGPException, IOException {
String compressed = "-----BEGIN PGP MESSAGE-----\n" +
"Version: PGPainless\n" +
"\n" +
"owHrKGVhEOZiYGNlSoxcsJtBkVMg3OzZZKnz5jxiiiz+aTG+h46kcR9zinOECZ/o\n" +
"YmTYsKve/opb3v/o8J0qq1/MFFBhP9jfEq+/avK6qPMrlh70Zfinu96c+cncX9GK\n" +
"B4ui3fUfbUo8tFrVTIRn7kROq69H77hd6cCw9susVdls1as1gNYunnp5V8Qp+wX3\n" +
"+jUnwoRB1p4SfPk412lb/cSmShb211fOX07h0JxVH1JXsc/vi2mi5ieG/2Xxb5tk\n" +
"LE+r7WwruxSaeXLuLsOmXTPZD0/VtvlqO89RYjsA\n" +
"=yZ18\n" +
"-----END PGP MESSAGE-----";
List<PGPSignature> signatures = SignatureUtils.readSignatures(compressed);
assertEquals(2, signatures.size());
assertEquals(KeyIdUtil.fromLongKeyId("5736E6931ACF370C"), signatures.get(0).getKeyID());
assertEquals(KeyIdUtil.fromLongKeyId("F49AAA6B067BAB28"), signatures.get(1).getKeyID());
}
@Test
public void noIssuerResultsInKeyId0() throws PGPException, IOException {
String sig = "-----BEGIN PGP SIGNATURE-----\n" +