PGPainless/pgpainless
PGPainless/pgpainless
1
0
Fork 0
mirror of https://github.com/pgpainless/pgpainless.git synced 2025-09-09 10:19:39 +02:00
Code Issues Releases Wiki Activity

Use relaxed PBE parameters

Browse source
This commit is contained in:
Paul Schaub 2025-03-13 15:31:44 +01:00
parent 36abac5fb3
commit 8a2b8c0ef0
Signed by: vanitasvitae
GPG key ID: 62BEE9264BF17311
4 changed files with 21 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

7
pgpainless-core/src/main/kotlin/org/pgpainless/key/generation/KeyRingBuilder.kt
View file

@ -19,6 +19,7 @@ import org.pgpainless.algorithm.KeyFlag
import org.pgpainless.algorithm.OpenPGPKeyVersion import org.pgpainless.algorithm.OpenPGPKeyVersion
import org.pgpainless.algorithm.SignatureType import org.pgpainless.algorithm.SignatureType
import org.pgpainless.bouncycastle.extensions.unlock import org.pgpainless.bouncycastle.extensions.unlock
import org.pgpainless.key.protection.KeyRingProtectionSettings
import org.pgpainless.policy.Policy import org.pgpainless.policy.Policy
import org.pgpainless.signature.subpackets.SelfSignatureSubpackets import org.pgpainless.signature.subpackets.SelfSignatureSubpackets
import org.pgpainless.signature.subpackets.SignatureSubpackets import org.pgpainless.signature.subpackets.SignatureSubpackets
@ -231,10 +232,14 @@ class KeyRingBuilder(
aead: Boolean aead: Boolean
): PBESecretKeyEncryptor? { ): PBESecretKeyEncryptor? {
check(passphrase.isValid) { "Passphrase was cleared." } check(passphrase.isValid) { "Passphrase was cleared." }
val protectionSettings = KeyRingProtectionSettings.secureDefaultSettings()
return if (passphrase.isEmpty) null return if (passphrase.isEmpty) null
else else
OpenPGPImplementation.getInstance() OpenPGPImplementation.getInstance()
.pbeSecretKeyEncryptorFactory(aead) .pbeSecretKeyEncryptorFactory(
aead,
protectionSettings.encryptionAlgorithm.algorithmId,
protectionSettings.s2kCount)
.build(passphrase.getChars(), publicKey.publicKeyPacket) .build(passphrase.getChars(), publicKey.publicKeyPacket)
} }

5
pgpainless-core/src/main/kotlin/org/pgpainless/key/protection/BaseSecretKeyRingProtector.kt
View file

@ -47,7 +47,10 @@ open class BaseSecretKeyRingProtector(
if (it.isEmpty) null if (it.isEmpty) null
else else
OpenPGPImplementation.getInstance() OpenPGPImplementation.getInstance()
.pbeSecretKeyEncryptorFactory(false) .pbeSecretKeyEncryptorFactory(
false,
protectionSettings.encryptionAlgorithm.algorithmId,
protectionSettings.s2kCount)
.build(it.getChars(), key.publicKeyPacket) .build(it.getChars(), key.publicKeyPacket)
} }
} }

13
pgpainless-core/src/main/kotlin/org/pgpainless/key/protection/KeyRingProtectionSettings.kt
View file

@ -19,7 +19,8 @@ import org.pgpainless.algorithm.SymmetricKeyAlgorithm
data class KeyRingProtectionSettings( data class KeyRingProtectionSettings(
val encryptionAlgorithm: SymmetricKeyAlgorithm, val encryptionAlgorithm: SymmetricKeyAlgorithm,
val hashAlgorithm: HashAlgorithm, val hashAlgorithm: HashAlgorithm,
val s2kCount: Int val s2kCount: Int,
val aead: Boolean
) { ) {
/** /**
@ -31,7 +32,7 @@ data class KeyRingProtectionSettings(
*/ */
constructor( constructor(
encryptionAlgorithm: SymmetricKeyAlgorithm encryptionAlgorithm: SymmetricKeyAlgorithm
) : this(encryptionAlgorithm, HashAlgorithm.SHA1, 0x60) ) : this(encryptionAlgorithm, HashAlgorithm.SHA1, 0x60, false)
init { init {
require(encryptionAlgorithm != SymmetricKeyAlgorithm.NULL) { require(encryptionAlgorithm != SymmetricKeyAlgorithm.NULL) {
@ -50,6 +51,12 @@ data class KeyRingProtectionSettings(
*/ */
@JvmStatic @JvmStatic
fun secureDefaultSettings() = fun secureDefaultSettings() =
KeyRingProtectionSettings(SymmetricKeyAlgorithm.AES_256, HashAlgorithm.SHA256, 0x60) KeyRingProtectionSettings(
SymmetricKeyAlgorithm.AES_256, HashAlgorithm.SHA256, 0x60, false)
@JvmStatic
fun aead() =
KeyRingProtectionSettings(
SymmetricKeyAlgorithm.AES_256, HashAlgorithm.SHA256, 0xff, true)
} }
} }

2
pgpainless-core/src/test/java/org/pgpainless/key/protection/InvalidProtectionSettingsTest.java
View file

@ -15,6 +15,6 @@ public class InvalidProtectionSettingsTest {
@Test @Test
public void unencryptedKeyRingProtectionSettingsThrows() { public void unencryptedKeyRingProtectionSettingsThrows() {
assertThrows(IllegalArgumentException.class, () -> assertThrows(IllegalArgumentException.class, () ->
new KeyRingProtectionSettings(SymmetricKeyAlgorithm.NULL, HashAlgorithm.SHA256, 0x60)); new KeyRingProtectionSettings(SymmetricKeyAlgorithm.NULL, HashAlgorithm.SHA256, 0x60, false));
} }
} }