PGPainless/pgpainless
PGPainless/pgpainless
1
0
Fork 0
mirror of https://github.com/pgpainless/pgpainless.git synced 2025-12-08 21:31:08 +01:00
Code Issues Releases Wiki Activity

Add workaround for decryption with non-encryption subkey

Browse source
This commit is contained in:
Paul Schaub 2025-02-18 15:14:04 +01:00
parent d656b5fda0
commit 95afc2cd30
Signed by: vanitasvitae
GPG key ID: 62BEE9264BF17311
3 changed files with 32 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
pgpainless-core/src/main/kotlin/org/pgpainless/decryption_verification/ConsumerOptions.kt
View file

@ -43,6 +43,7 @@ class ConsumerOptions {
private val decryptionPassphrases = mutableSetOf<Passphrase>()
private var missingKeyPassphraseStrategy = MissingKeyPassphraseStrategy.INTERACTIVE
private var multiPassStrategy: MultiPassStrategy = InMemoryMultiPassStrategy()
private var allowDecryptionWithNonEncryptionKey: Boolean = false
/**
* Consider signatures on the message made before the given timestamp invalid. Null means no
@ -328,6 +329,14 @@ class ConsumerOptions {
fun isIgnoreMDCErrors(): Boolean = ignoreMDCErrors
fun setAllowDecryptionWithNonEncryptionKey(allow: Boolean): ConsumerOptions = apply {
allowDecryptionWithNonEncryptionKey = allow
}
fun getAllowDecryptionWithNonEncryptionKey(): Boolean {
return allowDecryptionWithNonEncryptionKey
}
/**
* Force PGPainless to handle the data provided by the [InputStream] as non-OpenPGP data. This
* workaround might come in handy if PGPainless accidentally mistakes the data for binary

5
pgpainless-core/src/main/kotlin/org/pgpainless/decryption_verification/OpenPgpMessageInputStream.kt
View file

@ -409,6 +409,11 @@ class OpenPgpMessageInputStream(
val decryptionKeyCandidates = getDecryptionKeys(pkesk)
for (decryptionKeys in decryptionKeyCandidates) {
val secretKey = decryptionKeys.getSecretKeyFor(pkesk)!!
if (!secretKey.isEncryptionKey && !options.getAllowDecryptionWithNonEncryptionKey()) {
LOGGER.debug(
"Message is encrypted for ${secretKey.keyIdentifier}, but the key is not encryption capable.")
continue
}
if (hasUnsupportedS2KSpecifier(secretKey)) {
continue
}